Skip to content
OpenAdvisories
High ICSA-21-110-06 6 CVEs

Eaton Intelligent Power Manager

Published Apr 20, 2021 · Updated Apr 20, 2021

Vendor: Eaton Product: Intelligent Power manager (IPM) Product: Intelligent Power Manager Virtual Appliance (IPM VA) Product: Intelligent Power Protector (IPP)

Summary

Successful exploitation of these vulnerabilities could allow attackers to change certain settings, upload code, delete files, or execute commands.

Vulnerabilities 6

  • Critical 10.0
    CVE-2021-23281

    Remote Code execution

    Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially…

    Eaton Intelligent Power manager (IPM)
  • High 8.7
    CVE-2021-23278

    Arbitrary File delete

    Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action remov…

    Eaton Intelligent Power manager (IPM)
  • High 8.3
    CVE-2021-23277

    Improper Neutralization of Directives in Dynamically Evaluated Code

    Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/…

    Eaton Intelligent Power manager (IPM)
  • High 8.0
    CVE-2021-23279 EPSS 28%

    Arbitrary File delete

    Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker ca…

    Eaton Intelligent Power manager (IPM)
  • High 8.0
    CVE-2021-23280

    Arbitrary File upload

    Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious cod…

    Eaton Intelligent Power manager (IPM)
  • High 7.1
    CVE-2021-23276

    Improper Neutralization of Special Elements used in an SQL Command

    Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users…

    Eaton Intelligent Power manager (IPM)

Revision history

  1. #1

    ICSA-21-110-06 Eaton Intelligent Power Manager

References