CVE-2021-23277

10.0 criticalEPSS 1.0%

Critical (10.0) in eaton. EPSS 1.0% chance of exploitation in the next 30 days.

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWEs: CWE-94, CWE-95
Published: 2021-04-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eaton:intelligent_power_manager
eaton:intelligent_power_manager_virtual_appliance
eaton:intelligent_power_protector

References

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Check your stack JSON