Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2020-6651 CVE-2020-6652 |
CWE-ID | CWE-20 CWE-266 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Intelligent Power Manager Client/Desktop applications / Software for system administration |
Vendor | Eaton |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU27871
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-6651
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system
The vulnerability exists due to the affected software does not validate the import configuration file names properly within "system_srv.js". A remote authenticated attacker can send specially crafted file names while uploading the config file in the application and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIntelligent Power Manager: 1.67
External linkshttp://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
http://www.zerodayinitiative.com/advisories/ZDI-20-649/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU27872
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-6652
CWE-ID:
CWE-266 - Incorrect Privilege Assignment
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the target system.
The vulnerability exists due to incorrect privilege assignment within the mc2 binary. A local user can send specially crafted requests, upload the system configuration files and manipulate the system configurations.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIntelligent Power Manager: 1.67
External linkshttp://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
http://www.zerodayinitiative.com/advisories/ZDI-20-650/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.