Eaton

Records75All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high31CVSS 7.0–8.9

Exploited now

Eaton records in CISA KEV

No Eaton vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Intelligent Power Manager 12 records HIGH Intelligent Power Protector 12 records HIGH Intelligent Power Manager Virtual Appliance 5 records HIGH Easysoft 4 records LOW Foreseer Electrical Power Monitoring System 4 records MEDIUM Ups Companion 4 records MEDIUM 9px Ups Firmware 3 records LOW Elcsoft 3 records LOW

Records

12 records in Intelligent Power Manager · all components

TI-2021-06017 CVE-2021-23279 · GHSA-h7cg-8375-67fx

Arbitrary File delete

HIGH 65

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action usi…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.27947 Published 2021-04-13 Fixed in 1.69 CWE-20

TI-2018-08624 CVE-2018-12031 · GHSA-2v4v-8555-8jp6

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to…

MEDIUM 60

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.19477 Published 2018-06-07 No fix listed CWE-22

TI-2021-06019 CVE-2021-23281 · GHSA-p6w4-xgmf-8r7g

Remote code execution in Eaton Intelligent Power manager

MEDIUM 47

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02314 Published 2021-04-13 Fixed in 1.69 CWE-94

TI-2021-06015 CVE-2021-23277 · GHSA-qcjf-2v2g-8464

Improper Neutralization of Directives in Dynamically Evaluated Code

MEDIUM 45

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00997 Published 2021-04-13 Fixed in 1.69 CWE-95

TI-2021-06018 CVE-2021-23280 · GHSA-52vj-66ff-3q3r

Arbitrary file upload in Eaton Intelligent Power manager

MEDIUM 44

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00904 Published 2021-04-13 Fixed in 1.69 CWE-434

TI-2021-06016 CVE-2021-23278 · GHSA-9wgr-5887-h4gv

Arbitrary File delete

MEDIUM 43

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and serve…

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01052 Published 2021-04-13 Fixed in 1.69 CWE-20

TI-2020-05470 CVE-2020-6651 · GHSA-h5vj-g7qc-m75w

Command injection via specially crafted file name during config file upload

MEDIUM 42

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via speciall…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02147 Published 2020-05-07 No fix listed CWE-20

TI-2021-06014 CVE-2021-23276 · GHSA-c2vv-8742-cw24

Improper Neutralization of Special Elements used in an SQL Command

MEDIUM 40

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00821 Published 2021-04-13 Fixed in 1.69 CWE-89

TI-2021-06024 CVE-2021-23286 · GHSA-7pmh-g9pc-h622

Security issues in Eaton Intelligent Power Manager Infrastructure

LOW 35

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection.

CVSS 3.1HIGH 8.0 Adjacent network No auth User interaction EPSS 0.00419 Published 2022-04-18 No fix listed CWE-1236

TI-2020-05471 CVE-2020-6652 · GHSA-8wh6-v49g-v744

Incorrect privilege assignment allowing non-admin users to upload config files

LOW 34

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00356 Published 2020-05-07 No fix listed CWE-266

TI-2021-06025 CVE-2021-23287 · GHSA-gmcp-3xfw-qqwf

Security issues in Intelligent Power Manager (IPM 1)

LOW 26

The vulnerability exists due to insufficient validation of input of certain resources within the IPM software.

CVSS 3.1MEDIUM 5.6 Adjacent network High privileges User interaction EPSS 0.00462 Published 2022-04-01 Fixed in 1.70 CWE-79

TI-2021-06023 CVE-2021-23285 · GHSA-hxrm-74mf-m4wm

Security issues in Eaton Intelligent Power Manager Infrastructure

LOW 22

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00422 Published 2022-04-18 No fix listed CWE-79

Open these records in search →