9.6
CVE-2021-23278
- EPSS 0.1%
- Veröffentlicht 13.04.2021 19:15:14
- Zuletzt bearbeitet 21.11.2024 05:51:29
- Quelle CybersecurityCOE@eaton.com
- CVE-Watchlists
- Unerledigt
LoginEaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eaton ≫ Intelligent Power Manager Version < 1.69
Eaton ≫ Intelligent Power Manager Virtual Appliance Version < 1.69
Eaton ≫ Intelligent Power Protector Version < 1.68
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.1% | 0.246 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.6 | 3.1 | 5.8 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
|
| nvd@nist.gov | 5.5 | 8 | 4.9 |
AV:N/AC:L/Au:S/C:N/I:P/A:P
|
| CybersecurityCOE@eaton.com | 8.7 | 2.3 | 5.8 |
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.