CVE-2020-6651CWE-20

Command injection via specially crafted file name during config file upload

High · published May 7, 2020

CVSS v3.1
8.8
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02147 · 82.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-05-07T15:58Z
EPSS history
Timeline
  • 07 MAY 15:58Z
    Command injection via specially crafted file name during config file upload
    cvelistv5