What is CVE-2020-6651?

CVE-2020-6651 is a high-severity vulnerability in Eaton Intelligent Power Manager, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2020-05-07.

How severe is CVE-2020-6651?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Eaton Intelligent Power Manager

CVE-2020-6651

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.021 (80.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Eaton Intelligent_power_manager
Eaton Intelligent Power Manager (Ipm) — versions unspecified

Weakness classification (CWE)

References

CybersecurityCOE@eaton.com (x_refsource_MISC, Mitigation, Vendor Advisory)
CybersecurityCOE@eaton.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6651?: CVE-2020-6651 is a high-severity vulnerability in Eaton Intelligent Power Manager, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2020-05-07.
How severe is CVE-2020-6651?: High severity. CVSS v3 base score is 8.8 out of 10.