Improper Neutralization of Directives in Dynamically Evaluated Code
CVE-2021-23277

8.3HIGH

Key Information:

Vendor

Eaton

Status
Intelligent Power Manager (ipm)
Vendor
CVE Published:
13 April 2021

What is CVE-2021-23277?

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

Affected Version(s)

Intelligent Power manager (IPM) < 1.69

References

https://www.eaton.com/content/dam/eaton/company/news-insi...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amir Preminger from Claroty research
.