CVE-2021-23279highCWE-20

CVE-2021-23279: falha de alta gravidade em Eaton Intelligent Power manager (IPM)

Arbitrary File delete

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Intelligent Power manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

26Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 28%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Produtos afetados
Eaton · Intelligent Power manager (IPM)
CVEs relacionadas — Eaton Intelligent Power manager (IPM)

No mesmo produto, das mais perigosas para as menos.

CVE-2021-23281CRITICALRemote Code executionEPSS 2.3%CVE-2020-6651HIGHCommand injection via specially crafted file name during config file uploadEPSS 2.1%CVE-2021-23278HIGHArbitrary File deleteEPSS 1.1%CVE-2021-23277HIGHImproper Neutralization of Directives in Dynamically Evaluated CodeEPSS 1.0%CVE-2021-23280HIGHArbitrary File uploadEPSS 0.9%CVE-2021-23276HIGHImproper Neutralization of Special Elements used in an SQL CommandEPSS 0.8%