CVE-2021-22825

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-28 · updated 2026-06-17
Weakness: CWE-200

Description

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with NMC2 (V6.9.6 or earlier), AP7xxx and AP8xxx with NMC3 (V1.1.0.3 or earlier), and APDU9xxx with NMC3 (V1.0.0.28 or earlier)

Affected products

Schneider-Electric Rack Power Distribution Unit With Network Management Card 2 Firmware: before 7.0.6 — fixed in 7.0.6
Schneider-Electric Rack Power Distribution Unit With Network Management Card 3 Firmware: before 1.2.0.2 — fixed in 1.2.0.2

How to fix

Upgrade to a fixed version: Schneider-Electric Rack Power Distribution Unit With Network Management Card 2 Firmware 7.0.6; Schneider-Electric Rack Power Distribution Unit With Network Management Card 3 Firmware 1.2.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22825 or the next vulnerability affects your stack