CVE-2018-7820 - OpenCVE

A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Schneider-electric	Ap9631 Smart-ups Srt 5kva Firmware Ap9635 Firmware Ap9635 Ap9630 Firmware Ap9631 Firmware Smart-ups Srt 5kva Ap9630

Configuration 1 [-]

AND

cpe:2.3:o:schneider-electric:ap9630_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:ap9630:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:schneider-electric:smart-ups_srt_5kva_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:smart-ups_srt_5kva:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:schneider-electric:ap9631_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:ap9631:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:schneider-electric:ap9635_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:ap9635:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.apc.com/salestools/CCON-BFQMXC/CCON-BFQMXC_R0_EN.pdf	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: schneider

Published: 2019-09-17T19:45:32

Updated: 2019-09-17T19:45:32

Reserved: 2018-03-08T00:00:00

Link: CVE-2018-7820

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-09-17T20:15:11.000

Modified: 2023-03-01T01:22:43.477

Link: CVE-2018-7820

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:ap9630_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "789F5559-72FE-4620-A684-EF48D94FE0C0", "versionEndExcluding": "6.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:ap9630:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F506A9E-D04C-4A29-B6E8-F88BFF7629E0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:smart-ups_srt_5kva_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "03388B51-C023-4E2E-BE2F-1D73F461B105", "versionEndExcluding": "6.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:smart-ups_srt_5kva:-:*:*:*:*:*:*:*", "matchCriteriaId": "47BC2890-6BE7-4E5A-A751-BC60FF428EF3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:ap9631_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DCE6A12-CEB8-400F-AD0D-95EEFBC58050", "versionEndExcluding": "6.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:ap9631:-:*:*:*:*:*:*:*", "matchCriteriaId": "096C4C31-4CAC-447D-8F49-12535035DCF7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:ap9635_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D3D7DCD-6584-482A-BDFF-D22AC3DC841E", "versionEndExcluding": "6.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:ap9635:-:*:*:*:*:*:*:*", "matchCriteriaId": "A0AC4A1D-82AA-4836-B957-9CFF0DD22374", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled."}, {"lang": "es", "value": "Existe una vulnerabilidad CWE-255 de Administraci\u00f3n de Credenciales en APC UPS Network Management Card 2 AOS versi\u00f3n v6.5.6, lo que podr\u00eda causar que las Credenciales de Monitoreo Remoto sean visualizadas en texto plano cuando el Monitoreo Remoto est\u00e1 habilitado y luego deshabilitado."}], "id": "CVE-2018-7820", "lastModified": "2023-03-01T01:22:43.477", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-17T20:15:11.000", "references": [{"source": "cybersecurity@se.com", "tags": ["Vendor Advisory"], "url": "https://www.apc.com/salestools/CCON-BFQMXC/CCON-BFQMXC_R0_EN.pdf"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-255"}], "source": "cybersecurity@se.com", "type": "Secondary"}]}