TI-2020-05471 Aliases CVE-2020-6652 GHSA-8wh6-v49g-v744

Incorrect privilege assignment allowing non-admin users to upload config files

LOW 34CWE-266Published 2020-05-07 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters.

Why it matters now

EPSS 0.00356 29th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eaton	Intelligent Power manager (IPM)	up to 1.67	—	No fix listed	CNA

Intelligent Power manager (IPM) VendorEaton Affected up to 1.67 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:eaton:intelligent_power_manager::::::::	up to 1.67	Vulnerable	Eaton

cpe:2.3:a:eaton:intelligent_power_manager:*:*:*:*:*:*:*:* Versions up to 1.67 Vulnerable ·Eaton

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-6652
2026-10-03 Alias added: GHSA-8wh6-v49g-v744

References

Advisory 1

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf

Other 1

https://www.zerodayinitiative.com/advisories/ZDI-20-650/

TI-2021-06017 Arbitrary File delete CVSS 3.1CRITICAL 10.0
TI-2018-08624 Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to… CVSS 3.0CRITICAL 9.8
TI-2021-06019 Remote code execution in Eaton Intelligent Power manager CVSS 3.1CRITICAL 10.0
TI-2021-06015 Improper Neutralization of Directives in Dynamically Evaluated Code CVSS 3.1CRITICAL 10.0
TI-2021-06018 Arbitrary file upload in Eaton Intelligent Power manager CVSS 3.1CRITICAL 9.9
TI-2021-06016 Arbitrary File delete CVSS 3.1CRITICAL 9.6

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences