What is CVE-2021-23277?

CVE-2021-23277 is a high-severity vulnerability in Eaton Intelligent Power Manager, classified under Eval Injection. CVSS score: 8.3/10. Published 2021-04-13.

How severe is CVE-2021-23277?

High severity. CVSS v3 base score is 8.3 out of 10.

RCE in Eaton Intelligent Power Manager

CVE-2021-23277

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

EPSS: 0.010 (58.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Eaton Intelligent_power_manager
Eaton Intelligent Power Manager (Ipm) — versions unspecified
Eaton Intelligent_power_manager_virtual_appliance
Eaton Intelligent_power_protector

Weakness classification (CWE)

References

CybersecurityCOE@eaton.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-23277?: CVE-2021-23277 is a high-severity vulnerability in Eaton Intelligent Power Manager, classified under Eval Injection. CVSS score: 8.3/10. Published 2021-04-13.
How severe is CVE-2021-23277?: High severity. CVSS v3 base score is 8.3 out of 10.