Security issues in Eaton Intelligent Power Manager Infrastructure
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.
Description: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Metrics
Version
Base score
Base severity
Vector
3.1
5.7
MEDIUM
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Version:3.1
Base score:5.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
The product has reached its End Of Life, the notification has been posted at: Lifecycle Notification:
The transition to IPM Monitor Edition is in progress. Refer the Product page for further details.
Configurations
Workarounds
Exploits
Credits
Eaton thanks the ICS-Cert organization and individuals for their coordinated support on the security vulnerability: CVE-2021-23286 – Micheal Heinzl via ICS-Cert