CVE-2021-23279

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

CVSS v3 10.0 CRITICAL
CVSS v2.0 6.4 MEDIUM

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eaton:intelligent_power_manager::::::::
	cpe:2.3:a:eaton:intelligent_power_manager_virtual_appliance::::::::
	cpe:2.3:a:eaton:intelligent_power_protector::::::::

History

No history.

Information

Published : 2021-04-13 19:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-23279

Mitre link : CVE-2021-23279

CVE.ORG link : CVE-2021-23279

JSON object : View

Products Affected

eaton

intelligent_power_protector
intelligent_power_manager
intelligent_power_manager_virtual_appliance

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2021-23279", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 1.6}]}, "published": "2021-04-13T19:15:14.883", "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf", "tags": ["Vendor Advisory"], "source": "CybersecurityCOE@eaton.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed."}, {"lang": "es", "value": "Eaton Intelligent Power Manager (IPM) versiones anteriores a 1.69, es susceptible a una vulnerabilidad de eliminaci\u00f3n de archivos arbitrarios no autenticados inducida debido a una comprobaci\u00f3n inapropiada de entrada en la clase meta_driver_srv.js con la acci\u00f3n saveDriverData utilizando un driverID no v\u00e1lido. Un atacante puede enviar paquetes especialmente dise\u00f1ados para eliminar los archivos del sistema donde est\u00e1 instalado el software IPM"}], "lastModified": "2021-04-21T15:06:09.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eaton:intelligent_power_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E2C63CA-B479-49C4-8C98-F5AE9BF06A2F", "versionEndExcluding": "1.69"}, {"criteria": "cpe:2.3:a:eaton:intelligent_power_manager_virtual_appliance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10CFCD42-A9D6-468B-9287-03B4341B129A", "versionEndExcluding": "1.69"}, {"criteria": "cpe:2.3:a:eaton:intelligent_power_protector:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A67B7A8-E508-4854-9437-BF702692948C", "versionEndExcluding": "1.68"}], "operator": "OR"}]}], "sourceIdentifier": "CybersecurityCOE@eaton.com"}