CyberSec.Space Logo
CVEブラウザに戻る

CVE-2021-23278

HIGH
8.7
CVSS Severity Score
EPSS Score0.1480%
EPSS Percentile16.20th
Published2021年4月13日
Last Modified2024年11月21日

Vulnerability Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

Affected Platforms (CPE)

📦
Eaton

Intelligent Power Manager

< 1.69
📦
Eaton

Intelligent Power Manager Virtual Appliance

< 1.69
📦
Eaton

Intelligent Power Protector

< 1.68

References & Advisories

🔗 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf
🔗 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

関連する脆弱性情報

CVE-2021-2328110.0

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM soft...

CVE-2013-403110.0

The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Managemen...

CVE-2018-120319.8

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js d...

CVE-2020-66518.8

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import ...