CVE-2021-23280

UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using the “uploadBackground” function. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.