PT-2020-19205 · Eaton · Intelligent Power Manager

Ivathmican Sivakumaran · Published 2020-05-07 · Updated 2020-05-12 · CVE-2020-6651

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton's Intelligent Power Manager (IPM) versions 1.67 and prior

Description The issue is related to improper input validation on file names during configuration file import functionality. This allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.

Recommendations For versions 1.67 and prior, consider restricting the import of configuration files or validating file names to prevent specially crafted names from being uploaded until a fix is available. As a temporary workaround, avoid using the file import functionality for configuration files until the issue is resolved.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

CVE-2020-6651

ZDI-20-649

Affected Products

Intelligent Power Manager

References · 5

• https://zerodayinitiative.com/advisories/ZDI-20-649 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6651 · Vendor Advisory
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6651 · Security Note
• https://t.me/cvenotify/3620 · Telegram Post