PT-2020-19206 · Eaton · Eaton Intelligent Power Manager

Zebasquared · Published 2020-05-07 · Updated 2020-05-12 · CVE-2020-6652

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager versions 1.67 and prior

Description The issue allows non-admin users to upload system configuration files by sending specially crafted requests, potentially resulting in non-admin users manipulating system configurations via uploading configurations with incorrect parameters.

Recommendations For versions 1.67 and prior, consider restricting access to the system configuration upload feature to prevent non-admin users from manipulating system configurations until a patch is available. As a temporary workaround, limit the ability of non-admin users to send specially crafted requests to the system. Restrict access to system configuration files to minimize the risk of exploitation.

Fix

Incorrect Privilege Assignment

Improper Privilege Management

Weakness Enumeration

CWE-266

CWE-269

Related Identifiers

CVE-2020-6652

ZDI-20-650

Affected Products

Eaton Intelligent Power Manager

References · 5

• https://zerodayinitiative.com/advisories/ZDI-20-650 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-6652 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6652 · Vendor Advisory
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf · Vendor Advisory
• https://t.me/cvenotify/3621 · Telegram Post