Vulnerability · Published May 7, 2020 · Assigned by Eaton
CVE-2020-6651Command injection via specially crafted file name during config file upload
High 8.8
In plain English
A high-severity improper input validation in Intelligent Power manager (IPM) from Eaton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.1%top 17.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eaton | Intelligent Power manager (IPM) | unspecified – through 1.67 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H