CVE-2021-23281: Remote Code execution

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-13 · updated 2026-06-17
Weakness: CWE-94

Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code.

Affected products

Eaton Intelligent Power manager (IPM): before 1.69 — fixed in 1.69

How to fix

Upgrade to a fixed version: Eaton Intelligent Power manager (IPM) 1.69. Check the vendor advisory for mitigations.

References

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Get alerted when CVE-2021-23281 or the next vulnerability affects your stack