Vulnerabilities > CVE-2021-23278 - Unspecified vulnerability in Eaton products

CVSS 9.6 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

eaton

critical

NVD

Published: 2021-04-13

Updated: 2021-04-21

Summary

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

Vulnerable Configurations

Part	Description	Count
Application	Eaton Eaton Intelligent Power Manager 1.6 Eaton Intelligent Power Manager 1.67 Eaton Intelligent Power Manager Virtual Appliance * Eaton Intelligent Power Protector 1.10 Eaton Intelligent Power Protector 1.20 Eaton Intelligent Power Protector 1.28 Eaton Intelligent Power Protector 1.30 Eaton Intelligent Power Protector 1.42 Eaton Intelligent Power Protector 1.50 Eaton Intelligent Power Protector 1.52 Eaton Intelligent Power Protector 1.53 Eaton Intelligent Power Protector 1.61 Eaton Intelligent Power Protector 1.66 Eaton Intelligent Power Protector 1.67	14

References

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf