CVE-2021-23277

HIGH

Eaton Intelligent Power Manager < 1.69 - Unauthenticated Eval Injection in loadUserFile Function

Title source: llm

Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Scores

CVSS v3 8.3

EPSS 0.0096

EPSS Percentile 56.8%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-95 CWE-94

Status published

Products (3)

eaton/intelligent_power_manager < 1.69

eaton/intelligent_power_manager_virtual_appliance < 1.69

eaton/intelligent_power_protector < 1.68

Published Apr 13, 2021

Tracked Since Feb 18, 2026