CVE-2018-7820 Information disclosure in APC UPS Network Management Card 2 AOS
Attackers can view remote monitoring credentials in plaintext if the feature is enabled then disabled, exposing sensitive access data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7820?
CVE-2018-7820 is a critical vulnerability in Schneider Electric SE APC UPS Network Management Card 2 AOS, published on 17 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.
Which versions are affected by CVE-2018-7820?
It affects 4 products.
Products include Schneider-Electric Ap9630 Firmware, Schneider-Electric Ap9631 Firmware, Schneider-Electric Ap9635 Firmware, Schneider-Electric Smart-Ups Srt 5kva Firmware.
How do I fix CVE-2018-7820?
No fix has been published for CVE-2018-7820 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7820 being exploited?
There is no known exploitation of CVE-2018-7820 in the wild and no public exploit code.
Sources
Also known as GHSA-ff72-jpjq-gxxc.