CVE-2021-23280 – Eaton Intelligent Power Manager (IPM) versions ... (How to Fix)

Q: What is the severity of CVE-2021-23280?

CVE-2021-23280 has a CVSS score of 8.0 (HIGH). Eaton Intelligent Power Manager (IPM) versions before 1.69 allow authenticated attackers to upload arbitrary files, including malicious NodeJS code, via the maps_srv.js uploadBackgroud action. This can lead to remote code execution on affected systems. Organizations using IPM for power management are affected.

📋 TL;DR

Eaton Intelligent Power Manager (IPM) versions before 1.69 allow authenticated attackers to upload arbitrary files, including malicious NodeJS code, via the maps_srv.js uploadBackgroud action. This can lead to remote code execution on affected systems. Organizations using IPM for power management are affected.

💻 Affected Systems

Products:

Eaton Intelligent Power Manager (IPM)

Versions: All versions prior to 1.69

Operating Systems: Windows, Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated access to exploit, but default configurations may be vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with attacker gaining persistent access, executing arbitrary commands, and potentially moving laterally within the network.

🟠

Likely Case

Unauthorized file upload leading to web shell deployment and subsequent command execution on the IPM server.

🟢

If Mitigated

Limited impact with proper network segmentation and authentication controls preventing exploitation.

🌐 Internet-Facing: HIGH

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.69

Vendor Advisory: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Restart Required: Yes

Instructions:

1. Download IPM version 1.69 or later from Eaton's official portal. 2. Backup current configuration. 3. Install the update following Eaton's upgrade documentation. 4. Restart the IPM service.

🔧 Temporary Workarounds

Restrict Network Access

all

Limit access to IPM management interface to trusted IP addresses only.

Implement Strong Authentication

all

Enforce multi-factor authentication and strong password policies for IPM accounts.

🧯 If You Can't Patch

Isolate IPM system on dedicated VLAN with strict firewall rules
Implement application-level WAF with file upload filtering

🔍 How to Verify

Check if Vulnerable:

Check IPM version in web interface or configuration files. Versions below 1.69 are vulnerable.

Check Version:

Check web interface or consult IPM documentation for version display

Verify Fix Applied:

Confirm version is 1.69 or higher and test file upload functionality is properly restricted.

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads to maps_srv.js
Suspicious POST requests to uploadBackgroud endpoint
Unexpected NodeJS process execution

Network Indicators:

HTTP POST requests to /maps_srv.js with file upload parameters
Outbound connections from IPM server to unknown destinations

SIEM Query:

source="ipm_logs" AND (uri="/maps_srv.js" AND method="POST" AND params="uploadBackgroud")

📊 Metadata

CVE ID: CVE-2021-23280

CVSS v3 Score: 8.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-434

Published: April 13, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-23280, you might also want to check these: