Cross-Site Request Forgery and Scripting Vulnerabilities in Eaton UPS 9PX 8000 SP Devices

CVE-2018-9281

Summary

Eaton UPS 9PX 8000 SP devices contain vulnerabilities that allow an attacker to exploit CSRF flaws in the administration panel. Specifically, the change-password functionality can be manipulated, enabling an attacker to force a legitimate administrator to execute a silent password update without their consent. Additionally, the forms within the administration panel are vulnerable to Reflected Cross-Site Scripting (XSS) attacks. Malicious actors can craft a deceptive web page that, when visited by the logged-in administrator, triggers the execution of unwanted scripts, potentially allowing unauthorized actions and access to sensitive functionalities within the device.

References