CyberSec.Space Logo
CVEブラウザに戻る

CVE-2020-6651

HIGH
8.8
CVSS Severity Score
EPSS Score0.0370%
EPSS Percentile5.68th
Published2020年5月7日
Last Modified2024年11月21日

Vulnerability Description

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.

Affected Platforms (CPE)

📦
Eaton

Intelligent Power Manager

<= 1.67

References & Advisories

🔗 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
🔗 https://www.zerodayinitiative.com/advisories/ZDI-20-649/
🔗 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
🔗 https://www.zerodayinitiative.com/advisories/ZDI-20-649/

関連する脆弱性情報

CVE-2021-2328110.0

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM soft...

CVE-2013-403110.0

The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Managemen...

CVE-2018-120319.8

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js d...

CVE-2021-232788.7

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due...