CVE-2021-23277
Assigner: Eaton
Published: 2021-04-01T00:00:00
State: PUBLISHED
affected: product: Intelligent Power manager (IPM)
vendor: Eaton
versions: lessThan: 1.69
status: affected
version: unspecified
versionType: custom
credits: value: Amir Preminger from Claroty research 
datePublic: 2021-04-01T00:00:00
descriptions: value: Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
type: CWE
solutions: value: upgrade the software to latest version 1.69
source: advisory: ETN-VA-2021-1000
defect: ETN-VA-2021-1000
discovery: EXTERNAL
title: Improper Neutralization of Directives in Dynamically Evaluated Code
workarounds: value: To prevent the exploitation of the issues and safeguard the software from malicious entities, Eaton recommends blocking ports 4679 & 4680 at the enterprise network or home network where Intelligent Power Manager (IPM) software is installed and used
x_generator: engine: Vulnogram 0.0.9