Vulnerability Intelligence Report
Improper Neutralization of Directives in Dynamically Evaluated Code
CVE-2021-23277
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.
No Active Exploit Signals
CVSS Base Score
8.3
HIGH
Exploitability:1.7
Impact Score:6.1
EPSS Probability:0.96%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-95 ↗CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Eaton | Intelligent Power manager (IPM) | unspecified < 1.69 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.962%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Eaton · Vendor · Ireland |
| Reserved | 2021-01-08T00:00:00 |
| Published | 2021-04-13T18:04:16 |
| Patch Date | 2021-04-01 |
| Last Updated | 2024-09-16T18:38:30 |
Community Chatter & Buzz