Advisory Details

May 12th, 2020

Eaton Intelligent Power Manager mc2 Command Injection Remote Code Execution Vulnerability

CVE ID	CVE-2020-6651
CVSS SCORE	8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	Eaton
AFFECTED PRODUCTS	Intelligent Power Manager
VULNERABILITY DETAILS	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Eaton Intelligent Power Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within system_srv.js. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root on Linux or SYSTEM on Windows.
ADDITIONAL DETAILS	Eaton has issued an update to correct this vulnerability. More details can be found at: https://www.us-cert.gov/ics/advisories/icsa-20-133-01
DISCLOSURE TIMELINE	2019-12-23 - Vulnerability reported to vendor 2020-05-12 - Coordinated public release of advisory
CREDIT	Sivathmican Sivakumaran of Trend Micro Zero Day Initiative

BACK TO ADVISORIES