CVE-2018-7820: schneider electric se apc ups network management card 2 aos Credentials Management Errors
CVSS: 9.8v3.1CriticalModified
Published 17-09-2019Last modified 05-08-2024
Vulnerability summary
CVE-2018-7820 is a critical (CVSS 9.8) Credentials Management Errors vulnerability in schneider electric se apc ups network management card 2 aos. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.1% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
1.03%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 17-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.
CVSS metrics
2 scores · 1 source · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.03% on 18-09-2026
18-09-202618-10-2026
EPSS score1.03%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-255Credentials Management ErrorsWeaknesses in this category are related to the management of credentials.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Schneider-electric4 products
- ap9630_firmware< 6.7.2
- ap9631_firmware< 6.7.2
- ap9635_firmware< 6.7.2
- smart-ups_srt_5kva_firmware< 6.7.2
Schneider electric se1 product
2 vendors · 5 products