title: Security issues in Intelligent Power Protector
description: The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Protector versions prior to 1.69.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Intelligent Power Protector
vendor: Eaton
versions:
lessThan: 1.69, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
version: 3.1
]
solutions: Eaton has patched these security issues and new versions of the affected software are released. The latest versions can be downloaded from below location: -
Eaton IPM v1.69 – https://www.eaton.com/us/en-us/catalog/backup-power-ups-surge-it-power-distribution/eaton-intelligent-power-protector.resources.html