CVE-2018-12031 Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware a...
CriticalCVSS 9.8
EPSS 19.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Eaton intelligent power manager | = 1.6 | No fix listed |
References
- github.com exploit third-party-advisory