Eaton Intelligent Power Manager

Summary

Vulnerabilities 2

• High 8.8
  CVE-2020-6651

  Command injection via specially crafted file name during config file upload

  Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading th…

  Eaton Intelligent Power manager (IPM)
  May 7, 2020
• High 7.8
  CVE-2020-6652

  Incorrect privilege assignment allowing non-admin users to upload config files

  Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the sys…

  Eaton Intelligent Power manager (IPM)
  May 7, 2020

Revision history

1. 2020-05-12 #1

   ICSA-20-133-01 Eaton Intelligent Power Manager

References

• ICS Advisory ICSA-20-133-01 Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-20-133-01
• Recommended Practices
  https://www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B