Vulnerabilities for Intelligent power protector (...) - CXSECURITY.COM

Vulnerabilities for 'Intelligent power protector'

2022-04-19

CVE-2021-23283

CWE-79

Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.

2022-04-01

CVE-2021-23288

CWE-79

The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Protector versions prior to 1.69.

2021-04-13

CVE-2021-23280

CWE-434

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM�??s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.

CVE-2021-23279

CWE-20

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

CVE-2021-23278

NVD-CWE-noinfo

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

CVE-2021-23277

NVD-CWE-Other

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

CVE-2021-23276

CWE-89

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.

>>> Vendor: Eaton 18 Products

Network shutdown module

Xcomfort ethernet communication interface

Eamaxx series epdu firmware

Emaxxx series epdu firmware

Eswaxx series epdu firmware

Emaaxx series epdu firmware

Eamxxx series epdu firmware

Intelligent power manager

9px ups firmware

Intelligent power manager virtual appliance

Intelligent power protector

Copyright 2024, cxsecurity.com