A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and file download when an attacker navigates to the Network Management Card via HTTPS.

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and file download when an attacker navigates to the Network Management Card via HTTPS.

Schneider Electric is aware of a vulnerability in its Galaxy VL and Galaxy VS products. The Schneider Electric Galaxy VS products are 3-phase UPS for edge, small, and medium data centers and other business-critical applications. The Schneider Electric Galaxy VL products are 3-phase UPS featuring modular, redundant design and low TCO for medium and large data centers and mission critical environments. Failure to apply the remediations or mitigation provided below may risk path traversal, which could result in file system enumeration and file download.