Skip to main content

Intelligent Power Manager CVE-2020-6652

HIGH
Incorrect Privilege Assignment (CWE-266)
2020-05-07 CybersecurityCOE@eaton.com
Information Disclosure Intelligent Power Manager
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 07, 2020 - 16:15 nvd
HIGH 7.8

DescriptionNVD

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters.

AnalysisAI

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-266. Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters. Affected products include: Eaton Intelligent Power Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Intelligent Power Manager

View all
CVE-2018-12031 CRITICAL POC
9.8 Jun 07

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrad
CVE-2021-23281 CRITICAL
10.0 Apr 13

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability
CVE-2021-23279 CRITICAL
10.0 Apr 13

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability
CVE-2021-23277 CRITICAL
10.0 Apr 13

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. Rated
CVE-2021-23280 CRITICAL
9.9 Apr 13

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability.

CVE-2021-23278 CRITICAL
9.6 Apr 13

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability i
CVE-2021-23276 HIGH
8.8 Apr 13

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. Rated high severity (C
CVE-2020-6651 HIGH
7.3 May 07

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration fi

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8
CVE-2024-50485 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-6652 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy