CVE-2021-23276

· HIGHModified

← All CVEs

CVSS v3.1

7.1

EPSS

0.79%

Published

Apr 13, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89CWE-89

Affected Products (3)

eaton · intelligent_power_manager (up to 1.69)vulnerable

eaton · intelligent_power_manager_virtual_appliance (up to 1.69)vulnerable

eaton · intelligent_power_protector (up to 1.68)vulnerable

References (2)

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Vendor Advisory

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs