CVE-2018-7820

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-17 · updated 2026-06-17
Weakness: CWE-255

Description

A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.

Affected products

Schneider-Electric Ap9630 Firmware: before 6.7.2 — fixed in 6.7.2
Schneider-Electric Ap9631 Firmware: before 6.7.2 — fixed in 6.7.2
Schneider-Electric Ap9635 Firmware: before 6.7.2 — fixed in 6.7.2
Schneider-Electric Smart-Ups Srt 5Kva Firmware: before 6.7.2 — fixed in 6.7.2

How to fix

Upgrade to a fixed version: Schneider-Electric Ap9630 Firmware 6.7.2; Schneider-Electric Ap9631 Firmware 6.7.2; Schneider-Electric Ap9635 Firmware 6.7.2; Schneider-Electric Smart-Ups Srt 5Kva Firmware 6.7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-7820 or the next vulnerability affects your stack