Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

CVE-2020-6650

CVE-2020-6650 affects Eaton UPS companion software (v1.05 and earlier) with an Eval Injection in the Update Manager class. The software does not properly neutralize input before dynamic evaluation (e.g., eval), enabling arbitrary code execution on the host machine. Documented impact is arbitrary ...

CVE-2020-6650 Arbitrary code execution through “Update Manager” Class

UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates...