CVE-2021-23280

UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to an authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using the “uploadBackground” function. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.

Risk Information

  • CVE ID
  • CVE-2021-23280
  • Vendor
  • Eaton
  • Product
  • Eaton Intelligent Power Manager
  • CVSS v3
  • 8.0