CVE-2021-23280

Published: Apr 13, 2021Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.

Affected (3)

Products: Eaton: Intelligent Power Manager, Intelligent Power Manager Virtual Appliance, Intelligent Power Protector

3 products

Intelligent Power Manager

Intelligent Power Manager Virtual Appliance

Intelligent Power Protector

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Eaton Intelligent Power Manager	Before 1.69
Eaton Intelligent Power Manager Virtual Appliance	Before 1.69
Eaton Intelligent Power Protector	Before 1.68

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Source: CybersecurityCOE@eaton.com

Vendor Advisory

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.