Vulnerability · Published Apr 13, 2021 · Assigned by Eaton

CVE-2021-23280Arbitrary File upload

High 8.0

In plain English

A high-severity unrestricted file upload in Intelligent Power manager (IPM) from Eaton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.9%top 40.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Eaton	Intelligent Power manager (IPM)	unspecified – before 1.69

Weakness: CWE-434 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf x_refsource_MISC