APC Network Management Card 4 (NMC4): An unauthenticated attacker can manipulate URL parameters to walk out of the web

Impact

An unauthenticated attacker can manipulate URL parameters to walk out of the web root and read arbitrary system files off the card, including files like /etc/passwd — enough to harvest system account information and plan a follow-on attack against the UPS/PDU's management plane.

Who can reach it

Fully remote and unauthenticated — a crafted HTTP request with encoded directory-traversal sequences is enough.

What to do

Firmware flash of the NMC4 card to the fixed release. Roll out per card; the UPS/PDU keeps serving power to its load during the flash, but remote monitoring/management of that unit drops briefly.

References

Related entries

• Cisco Nexus Dashboard Fabric Controller (SSH host key validation): NDFC does not validate the SSH host keysCVE-2025-20163 · Cisco Nexus Dashboard Fabric Controller (SSH host key validation)High
• MinIO (S3 API, unsigned-trailer uploads): Signature validation on unsigned-trailer uploads is incomplete, so knowingCVE-2025-31489 · MinIO (S3 API, unsigned-trailer uploads)High
• HPE OneView for VMware vCenter (vertical privilege escalation): A read-only user performs administrative actionsCVE-2025-37101 · HPE OneView for VMware vCenter (vertical privilege escalation)High
• F5 BIG-IP (iHealth command / tmsh restricted shell): An authenticated attacker with at least a resource-administratorCVE-2025-61958 · F5 BIG-IP (iHealth command / tmsh restricted shell)High
• GitLab CE/EE: stored XSS in analytics dashboard pagination controlsCVE-2026-15216 · GitLab CE/EE (analytics dashboard pagination controls)High
• GitLab CE/EE: stored XSS in analytics dashboard table cell renderingCVE-2026-15217 · GitLab CE/EE (analytics dashboard table cell rendering)High