PT-2018-18957 · Eaton · Eaton Ups 9Px 8000 Sp

Published 2018-10-24 · Updated 2020-08-24 · CVE-2018-9281

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices (affected versions not specified)

Description The administration panel of the device is susceptible to a CSRF attack on the change-password functionality, allowing an attacker to silently update the password of a logged-in administrator. Additionally, the affected forms are vulnerable to Reflected Cross-Site Scripting vulnerabilities, which could be triggered by directing a logged-in administrator to a specially crafted web page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

CVE-2018-9281

Affected Products

Eaton Ups 9Px 8000 Sp

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2018-9281 · Security Note
• https://bishopfox.com/news/2018/10/eaton-ups-9px-8000-sp-multiple-vulnerabilities · Note