Read the docs
TI-2021-06019 Aliases CVE-2021-23281GHSA-p6w4-xgmf-8r7g

Remote code execution in Eaton Intelligent Power manager

Priority MEDIUM 47CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code.

Why it matters now

EPSS 0.02314 83rd percentileScored 2026-11-07
Fix Fixed Intelligent Power manager (IPM) (Eaton): 1.69

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
EatonIntelligent Power manager (IPM)before 1.691.69Patch availableCNA
  • Intelligent Power manager (IPM) VendorEaton Affected before 1.69 Fixed in 1.69 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eaton:intelligent_power_manager:*:*:*:*:*:*:*:*before 1.69VulnerableEaton
  • cpe:2.3:a:eaton:intelligent_power_manager:*:*:*:*:*:*:*:* Versions before 1.69 Vulnerable ·Eaton

Remediation

  • Fix · CNA Intelligent Power manager (IPM) (Eaton) Fixed in 1.69

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Eaton Intelligent Power manager (IPM) 1.69

    6 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM

    Other records, highest priority first

    • TI-2021-06017 Arbitrary File deletePriority HIGH 65
    • TI-2021-06015 Improper Neutralization of Directives in Dynamically Evaluated CodePriority MEDIUM 45
    • TI-2021-06018 Arbitrary file upload in Eaton Intelligent Power managerPriority MEDIUM 44
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23281
  2. 2026-10-03 Alias added: GHSA-p6w4-xgmf-8r7g

References

Advisory 1

  • TI-2021-06017 Arbitrary File delete CVSS 3.1CRITICAL 10.0
  • TI-2018-08624 Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to… CVSS 3.0CRITICAL 9.8
  • TI-2021-06015 Improper Neutralization of Directives in Dynamically Evaluated Code CVSS 3.1CRITICAL 10.0
  • TI-2021-06018 Arbitrary file upload in Eaton Intelligent Power manager CVSS 3.1CRITICAL 9.9
  • TI-2021-06016 Arbitrary File delete CVSS 3.1CRITICAL 9.6
  • TI-2020-05470 Command injection via specially crafted file name during config file upload CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences