CVE-2018-12031

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager version 1.6

Description The issue allows an attacker to perform a local file inclusion via directory traversal in the server/node upgrade srv.js. This is achieved by manipulating the firmware parameter in a downloadFirmware action.

Recommendations For Eaton Intelligent Power Manager version 1.6, consider restricting access to the downloadFirmware action and the firmware parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the firmware parameter in the affected API endpoint until the issue is resolved.