Multiple vulnerabilities in Eaton Intelligent Power Manager



Published: 2020-05-13
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2020-6651
CVE-2020-6652
CWE-ID CWE-20
CWE-266
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Intelligent Power Manager
Client/Desktop applications / Software for system administration

Vendor Eaton

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU27871

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6651

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system

The vulnerability exists due to the affected software does not validate the import configuration file names properly within "system_srv.js". A remote authenticated attacker can send specially crafted file names while uploading the config file in the application and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intelligent Power Manager: 1.67

External links

http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
http://www.zerodayinitiative.com/advisories/ZDI-20-649/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect Privilege Assignment

EUVDB-ID: #VU27872

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6652

CWE-ID: CWE-266 - Incorrect Privilege Assignment

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the target system.

The vulnerability exists due to incorrect privilege assignment within the mc2 binary. A local user can send specially crafted requests, upload the system configuration files and manipulate the system configurations.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Intelligent Power Manager: 1.67

External links

http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
http://www.zerodayinitiative.com/advisories/ZDI-20-650/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###