CVE-2021-22825: Schneider Electric Rack Power Distribution Unit With Network Management Card 2 Firmware

High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days.

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with NMC2 (V6.9.6 or earlier), AP7xxx and AP8xxx with NMC3 (V1.1.0.3 or earlier), and APDU9xxx with NMC3 (V1.0.0.28 or earlier)

Affected products

• Schneider Electric Rack Power Distribution Unit With Network Management Card 2 Firmware: before 7.0.6 (fixed in 7.0.6)
• Schneider Electric Rack Power Distribution Unit With Network Management Card 3 Firmware: before 1.2.0.2 (fixed in 1.2.0.2)

Published 2022-01-28. Last modified 2026-06-17.