PT-2021-15430 · Eaton · Eaton Intelligent Power Manager

Amir Preminger · Published 2021-04-13 · Updated 2023-06-26 · CVE-2021-23277

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager (IPM) versions prior to 1.69

Description The issue concerns an unauthenticated eval injection vulnerability. It arises because the software fails to neutralize code syntax from users before using it in the dynamic evaluation call in the loadUserFile function under scripts/libs/utils.js. This allows attackers to control the input to the function and execute attacker-controlled commands.

Recommendations For versions prior to 1.69, update to version 1.69 or later to resolve the issue. As a temporary workaround, consider restricting access to the loadUserFile function under scripts/libs/utils.js to minimize the risk of exploitation.

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2021-23277

Affected Products

Eaton Intelligent Power Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-23277 · Security Note
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23277 · Vendor Advisory