CVE-2024-58310: APC Network Management Card 4 Path Traversal

CVE-2024-58310 is a path traversal vulnerability (CWE-22) in the firmware of APC's Network Management Card 4, the network interface card used to remotely monitor and manage APC/Schneider Electric uninterruptible power supplies and power distribution units: an unauthenticated attacker can manipulate URL parameters with encoded path-traversal characters to read sensitive system files such as /etc/passwd directly off the device, and a public proof-of-concept exploit is already available; NVD has not, as of 2026-11-08, published its own Primary CVSS score, only a third-party disclosure score of 8.7 (CVSS v4.0, high).

CVE-2024-58310 (CWE-22, path traversal) affects APC's Network Management Card 4, the accessory network card that connects APC and Schneider Electric uninterruptible power supplies and power distribution units to the network for remote monitoring and control. NVD's description states: "APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like /etc/passwd by using encoded path traversal characters in HTTP requests" (NVD).

The flaw was disclosed by researcher Víctor García and catalogued by VulnCheck, whose advisory confirms the path-traversal mechanism and notes that a working proof-of-concept exploit for it has been published on Exploit-DB (exploit 51897) (VulnCheck Advisory). Because this came through a third-party coordinated-disclosure channel rather than a CISA ICS advisory or a Schneider Electric/APC security notification, no vendor-confirmed fixed firmware version is referenced in the records available for this review, and operators should check APC's own support channel for the current Network Management Card 4 firmware release (exploit-db.com/exploits/51897).

NVD tracks CVE-2024-58310 with status "Deferred": it records only a disclosure-source score (source [email protected]) — CVSS v4.0 8.7 (high), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD). The PR:N and UI:N components mean the reported exploitation path needs no authentication and no victim interaction, consistent with NVD's plain-text description of unauthenticated URL manipulation.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00901 (59.9th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis, and a public exploit already exists. In the meantime, operators of APC Network Management Card 4-equipped UPS and PDU devices should check for a current firmware release from APC's support channel and avoid exposing the card's web management interface to the internet.

• APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters; attackers can read files like /etc/passwd using encoded path traversal characters in HTTP requests. — NVD
• Disclosed by researcher Víctor García; catalogued by VulnCheck with a confirmed working proof-of-concept exploit published on Exploit-DB. — VulnCheck Advisory
• NVD status 'Deferred'; records only a disclosure-source Secondary CVSS v4.0 score of 8.7, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00901 (59.9th percentile) as of 2026-11-07. — FIRST EPSS