APC/Schneider Electric UPS, PDU, and cooling products using NMC2/NMC3 (Smart-UPS, Symmetra, Galaxy, rack PDUs, InRow

Impact

The card's troubleshooting archive — a diagnostic bundle that can contain configuration and log details — can be pulled off the device by someone who shouldn't have access to it, giving an attacker reconnaissance data useful for planning further attacks on that power/cooling unit.

Who can reach it

Network access to the card's web interface; the advisory describes this as an information-exposure issue reachable without full administrative rights.

What to do

Firmware upgrade per Schneider's SEVD-2021-313-03 advisory (fixed AOS versions vary by card generation — NMC2 vs NMC3). This spans a very wide product line (UPS, rack PDUs, cooling, NetBotz), so treat it as a fleet-wide inventory-and-patch exercise rather than a one-off fix.

References

Related entries

• AMI MegaRAC SPx 12 / SPx 13 (BMC login): The login flow answers differently for real and fake usernames, soCVE-2021-45925 · AMI MegaRAC SPx 12 / SPx 13 (BMC login)Medium
• AMI MegaRAC: Weak MD5 password hashing for BMC accountsCVE-2022-40258 · AMI MegaRACMedium
• AMD IOMMU - nested page table entry faults bypass SEV-SNP RMP checks: The IOMMU mishandles invalid nested page tableCVE-2023-20582 · AMD IOMMU - nested page table entry faults bypass SEV-SNP RMP checksMedium
• AMD IOMMU - invalid device table entries bypass SEV-SNP RMP checks: The IOMMU mishandles certain special address rangesCVE-2023-20584 · AMD IOMMU - invalid device table entries bypass SEV-SNP RMP checksMedium
• AMI MegaRAC SPX (Redfish): User enumeration through RedfishCVE-2023-25192 · AMI MegaRAC SPX (Redfish)Medium
• Insyde InsydeH2O (TrEEConfigDriver, TPM PCR reporting): Low CVSS, high operational consequenceCVE-2023-30633 · Insyde InsydeH2O (TrEEConfigDriver, TPM PCR reporting)Medium