CVE-2021-23277highCWE-95

CVE-2021-23277: high-severity vulnerability in Eaton Intelligent Power manager (IPM)

Improper Neutralization of Directives in Dynamically Evaluated Code

Published · Updated

Follow this CVE+ Monitor Intelligent Power manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 1.0%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Eaton · Intelligent Power manager (IPM)
Related CVEs — Eaton Intelligent Power manager (IPM)

In the same product, most dangerous first.

CVE-2021-23279HIGHArbitrary File deleteEPSS 27.9%CVE-2021-23281CRITICALRemote Code executionEPSS 2.3%CVE-2020-6651HIGHCommand injection via specially crafted file name during config file uploadEPSS 2.1%CVE-2021-23278HIGHArbitrary File deleteEPSS 1.1%CVE-2021-23280HIGHArbitrary File uploadEPSS 0.9%CVE-2021-23276HIGHImproper Neutralization of Special Elements used in an SQL CommandEPSS 0.8%