CVE-2020-6651: high-severity vulnerability in Eaton Intelligent Power manager (IPM)
Command injection via specially crafted file name during config file upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 2.1%
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Eaton · Intelligent Power manager (IPM)Related CVEs — Eaton Intelligent Power manager (IPM)
In the same product, most dangerous first.
CVE-2021-23279HIGHArbitrary File deleteEPSS 27.9%CVE-2021-23281CRITICALRemote Code executionEPSS 2.3%CVE-2021-23278HIGHArbitrary File deleteEPSS 1.1%CVE-2021-23277HIGHImproper Neutralization of Directives in Dynamically Evaluated CodeEPSS 1.0%CVE-2021-23280HIGHArbitrary File uploadEPSS 0.9%CVE-2021-23276HIGHImproper Neutralization of Special Elements used in an SQL CommandEPSS 0.8%