Main Vulnerability Database Vulnerabilities #VU52451

Eval Injection in Eaton products - CVE-2021-23277

Published: April 21, 2021

Vulnerability identifier: #VU52451

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23277

CWE-ID: CWE-95

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the system.

The vulnerability exists due to the affected software does not neutralize code syntax from users before using in the dynamic evaluation call in the "loadUserFile" function under scripts/libs/utils.js. A remote attacker on the local network can control the input to the function and execute attacker-controlled commands.

Affected software

Intelligent Power Protector
Intelligent Power Manager
Intelligent Power Manager Virtual Appliance

How to mitigate CVE-2021-23277

Install update from vendor's website.

Intelligent Power Protector - update to 1.68
Intelligent Power Manager - update to 1.69
Intelligent Power Manager Virtual Appliance - update to 1.69

External References

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Related Security Bulletins

Multiple vulnerabilities in Eaton Intelligent Power Manager