CVE-2021-23278

Published: Apr 13, 2021Modified: Jun 17, 2026

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Exploitability: 3.1 / Impact: 5.8

Source: NVD

Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

Affected (3)

Products: Eaton: Intelligent Power Manager, Intelligent Power Manager Virtual Appliance, Intelligent Power Protector

3 products

Intelligent Power Manager

Intelligent Power Manager Virtual Appliance

Intelligent Power Protector

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Eaton Intelligent Power Manager	Before 1.69
Eaton Intelligent Power Manager Virtual Appliance	Before 1.69
Eaton Intelligent Power Protector	Before 1.68

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Source: CybersecurityCOE@eaton.com

Vendor Advisory

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.