CVE-2021-23277 HIGH

CVE-2021-23277: Improper Neutralization of Directives in Dynamically Evaluated Code

Vendor Eaton
Product Intelligent Power manager (IPM)
Weakness CWE-95 · Eval injection
Published April 13, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

Key dates

02Disclosure timeline

April 13, 2021 CVE published
September 16, 2024 Record updated