ZDI-20-650: Eaton Intelligent Power Manager mc2 Incorrect Privilege Assignment Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Eaton Intelligent Power Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the mc2 binary. The issue results from the lack of proper validation of user privileges prior to performing privileged actions. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from non-admin users.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eaton Intelligent Power Manager Virtual Appliance |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-20-650?
The severity of ZDI-20-650 is considered high due to the potential for remote privilege escalation.
How do I fix ZDI-20-650?
To mitigate ZDI-20-650, update Eaton Intelligent Power Manager to the latest version where the vulnerability has been addressed.
Who is affected by ZDI-20-650?
Organizations using Eaton Intelligent Power Manager are affected by the ZDI-20-650 vulnerability.
What type of attacks can ZDI-20-650 enable?
ZDI-20-650 can enable remote attackers to escalate privileges on affected systems.
Is authentication required to exploit ZDI-20-650?
Yes, authentication is required to exploit the ZDI-20-650 vulnerability.
- agent/references
- agent/type
- agent/softwarecombine
- agent/title
- agent/severity
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-650
- alias/ZDI-CAN-11085
- alias/CVE-2020-6652
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/eaton
- canonical/eaton intelligent power manager virtual appliance