CVE-2020-6652 Incorrect privilege assignment allowing non-admin users to upload config files
Non-admin users can upload system configuration files, allowing them to manipulate settings and escalate privileges in Eaton Intelligent Power Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6652?
CVE-2020-6652 is a high-severity vulnerability in Eaton Intelligent Power manager (IPM), published on 7 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters.
Which versions are affected by CVE-2020-6652?
It affects 1 product.
Products include Eaton Intelligent Power Manager.
How do I fix CVE-2020-6652?
No fix has been published for CVE-2020-6652 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6652 being exploited?
There is no known exploitation of CVE-2020-6652 in the wild and no public exploit code.
Other vulnerabilities in Eaton Intelligent Power manager (IPM)
Sources
Also known as GHSA-8wh6-v49g-v744.