ICSA-21-110-06: Eaton Intelligent Power Manager
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit this vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.CVE-2021-23276 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in the loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker-controlled commands.CVE-2021-23277 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with the removeBackground function and server/node_upgrade_srv.js with the removeFirmware function. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.CVE-2021-23278 has been assigned to this vulnerability. A CVSS v3 base score of 8.7 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H). Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with the saveDriverData function using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.CVE-2021-23279 has been assigned to this vulnerability. A CVSS v3 base score of 8.0 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H). Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an authenticated arbitrary file upload vulnerability. IPM 's maps_srv.js allows an attacker to upload a malicious NodeJS file using the uploadBackground function. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.CVE-2021-23280 has been assigned to this vulnerability. A CVSS v3 base score of 8.0 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via the coverterCheckList function in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code.CVE-2021-23281 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 8.3