CVE-2018-9281

Eaton UPS 9PX 8000 SP product is affected by CVE-2018-9281, which involves a CSRF vulnerability in the change-password functionality that can force a logged-in administrator to silently update the password. The same flaw also enables Reflected Cross-Site Scripting in affected forms, potentially e...

CVE-2018-9279

CVE-2018-9279 affects Eaton UPS 9PX 8000 SP devices. The web UI exposes the user password in cleartext and the password can be retrieved by inspecting the page source. Multiple sources (NVD/NES plugins, CNVD) describe this disclosure vulnerability. The connected documents do not provide a remedia...

PT-2018-18956

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices affected versions not specified Description An issue was discovered where the appliance discloses the SNMP version 3 user's password. The password is displayed in cleartext on the web page and can also be retrieve...

PT-2018-18955

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices affected versions not specified Description The issue concerns the disclosure of user passwords. The web page displayed by the appliance contains the password in cleartext, allowing passwords to be retrieved by...

CVE-2018-9280: Insufficiently Protected Credentials

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwords of the read and write users could be retrieved by browsing the source code of the webpage...

PT-2018-18957

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices affected versions not specified Description The administration panel of the device is susceptible to a CSRF attack on the change-password functionality, allowing an attacker to silently update the password of a...

CVE-2018-9281: Improper Neutralization of Input During Web Page Generation

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...

CVE-2018-9279: Insufficiently Protected Credentials

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage...