CVE-2020-6651: Eaton Intelligent Power Manager mc2 Command Injection Remote Code Execution Vulnerability
First published: Thu May 07 2020(Updated: )
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
Credit: CybersecurityCOE@eaton.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eaton Intelligent Power Manager | ||
| Eaton Intelligent Power Manager | <=1.67 |
Remedy
Update the software to latest version 1.68.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-6651.
What is the title of this vulnerability?
The title of this vulnerability is Eaton Intelligent Power Manager mc2 Command Injection Remote Code Execution Vulnerability.
What is the severity of CVE-2020-6651?
The severity of CVE-2020-6651 is high with a severity value of 8.8.
Which software is affected by this vulnerability?
The Eaton Intelligent Power Manager software is affected by this vulnerability.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by executing arbitrary code on affected installations of Eaton Intelligent Power Manager.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/title
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/remedy
- agent/description
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-649
- alias/ZDI-CAN-9854
- alias/CVE-2020-6651
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- vendor/eaton
- canonical/eaton intelligent power manager
- version/eaton intelligent power manager/1.67