by Kastro
Paper/Archive/CVE-2021-23279

CVE-2021-23279

Eaton Intelligent Power manager (IPM) — Arbitrary File delete

EPSS 27%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 98.0.980 × 2019.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

Affected

ProductAffectedFixed inSource
Intelligent Power manager (IPM)unspecified – < 1.691.69CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Eaton (CNA)8.0CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

References

refeaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf