SEVD-2020-174-01

Schneider Electric became aware of multiple vulnerabilities affecting Treck Inc.'s embedded TCP/IP stack, collectively known as Ripple20, which Treck publicly disclosed on June 16, 2020. Schneider Electric is also aware of a proof of concept published by JSOF that demonstrates how one of the Treck vulnerabilities, CVE-2020-11901, can be exploited to affect a Schneider Electric APC SmartUPS device using certain Network Management Card firmware versions. On October 12, 2020, Schneider Electric received additional information and analysis from JSOF related to CVE-2020-11901’s impact on APC by Schneider Electric Network Management Cards and NMC embedded devices. This new analysis indicates that the information we originally received was incomplete. Therefore our original remediations are only partially effective for CVE-2020-11901. We are expediting updated remediations, which will be made available as soon as possible. In the meantime, customers should immediately apply the mitigations included in Remediation & Mitigations section of this document. June 2021 Update: Added remediations for Uninterruptible Power Supply (UPS), Rack Power Distribution Units (rPDU), Battery Management, Rack Automatic Transfer Switch (ATS), Rack Air Removal Unit (RARU) using NMC1, as well as all other remaining NMC1 applications.