TI-2021-06021 Aliases CVE-2021-23283 GHSA-r333-6m87-xrr9

Security issues in Eaton Intelligent Power Protector (IPP)

LOW 25CWE-79Published 2022-04-19 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.

Why it matters now

EPSS 0.00531 45th percentileScored 2026-11-08

Fix Fixed Eaton Intelligent Power Protector (IPP) (Eaton): 1.69 release 166

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eaton	Eaton Intelligent Power Protector (IPP)	before 1.69 release 166	1.69 release 166	Patch available	CNA

Eaton Intelligent Power Protector (IPP) VendorEaton Affected before 1.69 release 166 Fixed in 1.69 release 166 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:eaton:intelligent_power_protector::::::::	before 1.69	Vulnerable	Eaton

cpe:2.3:a:eaton:intelligent_power_protector:*:*:*:*:*:*:*:* Versions before 1.69 Vulnerable ·Eaton

Remediation

Fix · CNA Eaton Intelligent Power Protector (IPP) (Eaton) Fixed in 1.69 release 166

Timeline

2026-10-02 Threatist record created from CVE-2021-23283
2026-10-03 Alias added: GHSA-r333-6m87-xrr9

References

Patch 1

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Protector-Vulnerability-Advisory_1001b_V1.0.pdf

TI-2021-06017 Arbitrary File delete CVSS 3.1CRITICAL 10.0
TI-2021-06015 Improper Neutralization of Directives in Dynamically Evaluated Code CVSS 3.1CRITICAL 10.0
TI-2021-06018 Arbitrary file upload in Eaton Intelligent Power manager CVSS 3.1CRITICAL 9.9
TI-2026-18180 Uncontrolled search path in Eaton IPP software CVSS 3.1CRITICAL 9.9
TI-2021-06016 Arbitrary File delete CVSS 3.1CRITICAL 9.6
TI-2021-06014 Improper Neutralization of Special Elements used in an SQL Command CVSS 3.1HIGH 8.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences