APC UPS Network Management Card 2 (AOS 6.5.6): When Remote Monitoring is turned on and then off again, the credentials

Impact

When Remote Monitoring is turned on and then off again, the credentials used for remote monitoring stay viewable in plaintext on the card. Anyone who gets a look at the card's config (via the web UI, a config export, or a support dump) picks up a working credential to the UPS's remote-monitoring channel.

Who can reach it

Requires some access to the card's configuration or web interface (e.g. a lower-privileged account, an exported config file, or a support bundle) — not a fully unauthenticated remote exploit, but a credential-exposure path.

What to do

Credential rotation for the affected remote-monitoring account is the immediate fix; pair it with the AOS firmware update from APC that stops persisting the credential in plaintext once monitoring is disabled. Rotate credentials across the whole NMC2 fleet, not just the units you know were exposed.

References