How severe is CVE-2018-12031?

CVE-2018-12031 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-12031 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 20% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-12031?

CVE-2018-12031 affects Eaton Intelligent Power Manager. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-12031?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2018-12031 published?

CVE-2018-12031 was published on 2018-06-07 and last updated on 2026-06-17.

CVE-2018-12031

CVE-2018-12031 is a critical-severity vulnerability in Eaton Intelligent Power Manager with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 20% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-22.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 20% (97th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-22
Affected product: Eaton Intelligent Power Manager
Published: 2018-06-07
Last modified: 2026-06-17

Description

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.

Frequently asked questions

What is CVE-2018-12031?: Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.
How severe is CVE-2018-12031?: CVE-2018-12031 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-12031 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 20% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-12031?: CVE-2018-12031 affects Eaton Intelligent Power Manager. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-12031?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2018-12031 published?: CVE-2018-12031 was published on 2018-06-07 and last updated on 2026-06-17.

References

https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion

Affected products (1)

cpe:2.3:a:eaton:intelligent_power_manager:1.6:*:*:*:*:*:*:*

More vulnerabilities in Eaton Intelligent Power Manager

CVE-2021-23281 — Critical (CVSS 10.0): Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution…
CVE-2020-6651 — High (CVSS 8.8): Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration…
CVE-2021-23278 — High (CVSS 8.7): Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability…
CVE-2021-23277 — High (CVSS 8.3): Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The…
CVE-2021-23280 — High (CVSS 8.0): Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability.…
CVE-2021-23279 — High (CVSS 8.0): Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete…

All CVEs affecting Eaton Intelligent Power Manager →

Other CWE-22 (Path Traversal) vulnerabilities

CVE-2026-55393 — Critical (CVSS 10.0): Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9…
CVE-2026-97163 — Critical (CVSS 10.0): Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
CVE-2026-80155 — Critical (CVSS 10.0): Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,…
CVE-2026-70200 — Critical (CVSS 10.0): Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an…
CVE-2026-85706 — Critical (CVSS 10.0): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9,…
CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.

Browse all CWE-22 (Path Traversal) vulnerabilities →