CRITICAL🇵🇱 Wersja polska

CVE-2018-12031

CVSS 9.8v3.0pub. 2018-06-07upd. 2024-11-21

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Eaton Intelligent Power Manager

    APP
    Eaton
    1.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2021-23281CRITICAL10.0PL ✓same product

Eaton IPM – nieuwierzytelniony RCE przez fałszywy serwer SNMP

CVE-2021-23276HIGH7.1same product

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious ...

CVE-2021-23277HIGH8.3same product

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerabil...

CVE-2021-23278HIGH8.7same product

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulne...

CVE-2021-23279HIGH8.0same product

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vul...