What’s Vulnerable › Vulnerabilities

CVE-2021-23277: Improper Neutralization of Directives in Dynamically Evaluated Code

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-13 · updated 2026-06-17
• Weakness: CWE-95

Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

Affected products

• Eaton Intelligent Power manager (IPM): before 1.69 — fixed in 1.69
• Eaton Intelligent Power Manager Virtual Appliance: before 1.69 — fixed in 1.69
• Eaton Intelligent Power Protector: before 1.68 — fixed in 1.68

How to fix

Upgrade to a fixed version: Eaton Intelligent Power manager (IPM) 1.69; Eaton Intelligent Power Manager Virtual Appliance 1.69; Eaton Intelligent Power Protector 1.68. Check the vendor advisory for mitigations.

References

• https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf
• https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Get alerted when CVE-2021-23277 or the next vulnerability affects your stack