PT-2022-9392 · Eaton · Eaton Intelligent Power Manager Infrastructure

Published 2022-04-18 · Updated 2022-04-27 · CVE-2021-23286

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) versions 1.5.0plus205 and prior versions.

Description The issue is related to CSV Formula Injection. This affects all versions of Eaton Intelligent Power Manager Infrastructure prior to and including version 1.5.0plus205.

Recommendations For versions 1.5.0plus205 and prior, update to a version that is not affected by this issue, as all versions prior to and including 1.5.0plus205 are vulnerable.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-23286

Affected Products

Eaton Intelligent Power Manager Infrastructure

References · 5

• https://osv.dev/vulnerability/CVE-2021-23286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23286 · Security Note
• https://t.me/cvenotify/29362 · Telegram Post
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Manager-%28IPM%29-Infrastructure-Vulnerability-Advisory_1001c_V1.0.pdf · Note
• https://eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/power-management-software-connectivity/eaton-intelligent-power-manager/software/ipm-understand-edition-emea/eaton-ipminfra-eolmemo-en-us.pdf. · Note