CVE-2021-23280 — Arbitrary File upload
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a maliciou…
Published: 2021-04-13 · CVSS: 8.0 · CVSS 3.1
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7