CVE-2020-6652: Eaton Intelligent Power Manager mc2 Incorrect Privilege Assignment Privilege Escalation Vulnerability
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters.
Other sources
This vulnerability allows remote attackers to escalate privileges on affected installations of Eaton Intelligent Power Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the mc2 binary. The issue results from the lack of proper validation of user privileges prior to performing privileged actions. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from non-admin users.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-6652.
What is the severity of CVE-2020-6652?
The severity of CVE-2020-6652 is high with a CVSS score of 7.8.
What software is affected by CVE-2020-6652?
The Eaton Intelligent Power Manager with a version up to 1.67 is affected by CVE-2020-6652.
How can an attacker exploit CVE-2020-6652?
An attacker can exploit CVE-2020-6652 by escalating privileges on affected installations of Eaton Intelligent Power Manager.
Is authentication required to exploit CVE-2020-6652?
Yes, authentication is required to exploit CVE-2020-6652.