CVE-2021-23276 Improper Neutralization of Special Elements used in an SQL Command

What is CVE-2021-23276?

CVE-2021-23276 is a high-severity vulnerability in Eaton Intelligent Power manager (IPM), published on 13 Apr 2021.

Official description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.

Weakness: CWE-89

Which versions are affected by CVE-2021-23276?

It affects 3 products.

Products include Eaton Intelligent Power Manager, Eaton Intelligent Power Manager Virtual Appliance, Eaton Intelligent Power Protector.

How do I fix CVE-2021-23276?

No fix has been published for CVE-2021-23276 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-23276 being exploited?

There is no known exploitation of CVE-2021-23276 in the wild and no public exploit code.

Other vulnerabilities in Eaton Intelligent Power manager (IPM)

• CVE-2021-23281 Remote Code execution Critical 10.0
• CVE-2018-12031 Path traversal in n/a Critical 9.8
• CVE-2020-6651 Command injection via specially crafted file name during config file upload High 8.8
• CVE-2021-23278 Arbitrary File delete High 8.7
• CVE-2021-23277 Improper Neutralization of Directives in Dynamically Evaluated Code High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c2vv-8742-cw24.