SQL injection in Eaton products - CVE-2021-23276
Published: April 21, 2021
Vulnerability identifier: #VU52450
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-23276
CWE-ID: CWE-89
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote authenticated attacker on the local network can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
Intelligent Power Protector
Intelligent Power Manager
Intelligent Power Manager Virtual Appliance
Intelligent Power Manager
Intelligent Power Manager Virtual Appliance
How to mitigate CVE-2021-23276
Install update from vendor's website.
Intelligent Power Protector - update to 1.68
Intelligent Power Manager - update to 1.69
Intelligent Power Manager Virtual Appliance - update to 1.69
Intelligent Power Manager - update to 1.69
Intelligent Power Manager Virtual Appliance - update to 1.69