Schneider Electric Network Management Card 3 Firmware vulnerabilities

6 CVEs affecting Schneider Electric Network Management Card 3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22815, published 2022-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22815, published 2022-01-28. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including…
CVE-2021-22810, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a…
CVE-2021-22814, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists which could cause arbritrary script execution when a malicious file is read and…
CVE-2021-22813, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a…
CVE-2021-22812, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a…
CVE-2021-22811, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause script execution when the request of a privileged account…