CVE-2018-12031

Exploitation likely. EPSS gives it a 19% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.09.8Critical EPSS percentile97th19% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2018-06-07Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run Eaton Intelligent Power Manager and confirm whether the installed version is v1.6.
Limit access to the Intelligent Power Manager web interface to trusted administrator networks; remove public internet access.
Contact Eaton or your support provider for the exact fixed version or official mitigation, as no patch information is currently available.
Review web-server and application logs for unusual requests to the firmware-download function or file-path manipulation attempts.

May need vendor or contractor work

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.

In plain language

Written by AI from the record

Eaton Intelligent Power Manager v1.6 has a critical flaw that can let an internet attacker take control of the system, so affected businesses should act now.

Unauthenticated directory traversal/local file inclusion in Eaton Intelligent Power Manager v1.6 through the firmware parameter of the downloadFirmware action in server/node_upgrade_srv.js.

If you're affected

Power-management system takeover
Configuration data exposure
Service disruption
Potential ransomware entry point

What is it

This is a weakness in the software’s firmware-download feature that may let an outsider make the system retrieve files it was never meant to expose. It is like a maintenance clerk accepting a forged filing request that gives access to rooms behind the counter.

Who is affected

This matters to you if you run Eaton Intelligent Power Manager to monitor or manage power equipment. It is especially important where the product’s web management interface can be reached by untrusted networks.

How urgent is it

No confirmed active exploitation is reported, and the issue is not listed in CISA’s known-exploited-vulnerabilities catalog. However, the flaw is critical and can be attacked remotely without an account, so treat access restrictions and vendor follow-up as a near-term priority.

What to do — in detail

Confirm exposure by inventorying Eaton Intelligent Power Manager deployments, identifying instances at version v1.6, and determining whether their management interfaces are exposed beyond an administrator-only network. No vendor fixed version or patch is available in the supplied findings, so do not assume an upgrade target; obtain an official Eaton advisory or support response before changing versions.

If patching is delayed, place the management interface behind a VPN or internal management network, allow only required administrator source addresses, and block untrusted access to the firmware-download functionality where your network controls permit it. Review application and web logs for suspicious requests involving downloadFirmware, the firmware parameter, traversal sequences such as ../, or unexpected file paths. CISA has not assigned a KEV due date because this CVE is not listed in KEV.

Technical context

CVSS v3.0: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The reported weakness is CWE-22 directory traversal leading to local file inclusion through the firmware parameter in the downloadFirmware action of server/node_upgrade_srv.js. No CISA KEV listing or confirmed exploitation is present in the findings; exploit evidence is limited to a detection template. EPSS predicts 6.4% likelihood (93rd percentile) with a falling trend. No patch information is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS97th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

19% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3030 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

eatoncommercial · US
- intelligent power managerOn-premICS / OT / IoT / building-automation

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable