Command injection via specially crafted file name during config file upload
Vulnerability Description
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-6651
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Eaton would like to thank Sivathmican Sivakumaran for working with Eaton and helping Eaton in releasing more robust and secure products.
References
More from Eaton
View All →Affected Vendor
Eaton
View all reports →