PT-2021-15433 · Eaton · Eaton Intelligent Power Manager

Amir Preminger · Published 2021-04-13 · Updated 2021-04-21 · CVE-2021-23280

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager (IPM) versions prior to 1.69

Description The issue allows for authenticated arbitrary file upload. Specifically, the maps srv.js component is vulnerable, enabling an attacker to upload malicious NodeJS files using the uploadBackgroud action. This can be exploited by sending a specially crafted packet, potentially allowing the execution of arbitrary commands or the upload of malicious code.

Recommendations For versions prior to 1.69, update to version 1.69 or later to resolve the issue. As a temporary workaround, consider restricting access to the maps srv.js component and the uploadBackgroud action to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-23280

Affected Products

Eaton Intelligent Power Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-23280 · Security Note
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23280 · Vendor Advisory