Sign-up

ID

VAR-202104-1555


CVE

CVE-2021-23279


TITLE

Eaton Intelligent Power Manager Arbitrary File Deletion Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2021-31671

DESCRIPTION

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed. Eaton Intelligent Power Manager (IPM) is an intelligent power manager from Eaton, USA. It supports remote monitoring and management of multiple devices in the network from the interface. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.07

sources: NVD: CVE-2021-23279 // CNVD: CNVD-2021-31671 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-23279

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-31671

AFFECTED PRODUCTS

vendor:eatonmodel:intelligent power managerscope:ltversion:1.69

Trust: 1.6

vendor:eatonmodel:intelligent power protectorscope:ltversion:1.68

Trust: 1.0

vendor:eatonmodel:intelligent power manager virtual appliancescope:ltversion:1.69

Trust: 1.0

sources: CNVD: CNVD-2021-31671 // NVD: CVE-2021-23279

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-23279
value: CRITICAL

Trust: 1.0

CybersecurityCOE@eaton.com: CVE-2021-23279
value: HIGH

Trust: 1.0

CNVD: CNVD-2021-31671
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-901
value: CRITICAL

Trust: 0.6

VULMON: CVE-2021-23279
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-23279
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2021-31671
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-23279
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.8
version: 3.1

Trust: 1.0

CybersecurityCOE@eaton.com: CVE-2021-23279
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.8
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2021-31671 // VULMON: CVE-2021-23279 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-901 // NVD: CVE-2021-23279 // NVD: CVE-2021-23279

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

sources: NVD: CVE-2021-23279

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202104-901

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:Patch for Eaton Intelligent Power Manager Arbitrary File Deletion Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/261891

Trust: 0.6

sources: CNVD: CNVD-2021-31671

EXTERNAL IDS

db:NVDid:CVE-2021-23279

Trust: 2.3

db:CNVDid:CNVD-2021-31671

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:ICS CERTid:ICSA-21-110-06

Trust: 0.6

db:CS-HELPid:SB2021042130

Trust: 0.6

db:CNNVDid:CNNVD-202104-901

Trust: 0.6

db:VULMONid:CVE-2021-23279

Trust: 0.1

sources: CNVD: CNVD-2021-31671 // VULMON: CVE-2021-23279 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-901 // NVD: CVE-2021-23279

REFERENCES

url:https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-23279

Trust: 1.2

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-110-06

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021042130

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-31671 // VULMON: CVE-2021-23279 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-901 // NVD: CVE-2021-23279

SOURCES

db:CNVDid:CNVD-2021-31671
db:VULMONid:CVE-2021-23279
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202104-901
db:NVDid:CVE-2021-23279

LAST UPDATE DATE

2024-11-23T21:16:42.955000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-31671date:2021-04-28T00:00:00
db:VULMONid:CVE-2021-23279date:2021-04-21T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202104-901date:2021-04-22T00:00:00
db:NVDid:CVE-2021-23279date:2024-11-21T05:51:29.413

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-31671date:2021-04-28T00:00:00
db:VULMONid:CVE-2021-23279date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202104-901date:2021-04-13T00:00:00
db:NVDid:CVE-2021-23279date:2021-04-13T19:15:14.883