CVE-2020-6651: Eaton Intelligent Power Manager mc2 Command Injection Remote Code Execution Vulnerability
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Eaton Intelligent Power Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within systemsrv.js. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root on Linux or SYSTEM on Windows.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-6651.
What is the title of this vulnerability?
The title of this vulnerability is Eaton Intelligent Power Manager mc2 Command Injection Remote Code Execution Vulnerability.
What is the severity of CVE-2020-6651?
The severity of CVE-2020-6651 is high with a severity value of 8.8.
Which software is affected by this vulnerability?
The Eaton Intelligent Power Manager software is affected by this vulnerability.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by executing arbitrary code on affected installations of Eaton Intelligent Power Manager.