CVE-2021-23278highCWE-20

CVE-2021-23278: falha de alta gravidade em Eaton Intelligent Power manager (IPM)

Arbitrary File delete

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Intelligent Power manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 1.1%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Produtos afetados
Eaton · Intelligent Power manager (IPM)
CVEs relacionadas — Eaton Intelligent Power manager (IPM)

No mesmo produto, das mais perigosas para as menos.

CVE-2021-23279HIGHArbitrary File deleteEPSS 27.9%CVE-2021-23281CRITICALRemote Code executionEPSS 2.3%CVE-2020-6651HIGHCommand injection via specially crafted file name during config file uploadEPSS 2.1%CVE-2021-23277HIGHImproper Neutralization of Directives in Dynamically Evaluated CodeEPSS 1.0%CVE-2021-23280HIGHArbitrary File uploadEPSS 0.9%CVE-2021-23276HIGHImproper Neutralization of Special Elements used in an SQL CommandEPSS 0.8%