Eaton vulnerabilities
72 vulnerabilities
Known vulnerabilities in Eaton products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 76 products.
Products
50 of 76- Intelligent Power Protector13 vulnerabilities
- Intelligent Power Manager12 vulnerabilities
- Intelligent Power Manager (Ipm)9 vulnerabilities
- Intelligent Power Manager Virtual Appliance5 vulnerabilities
- IPP Software5 vulnerabilities
- Easysoft4 vulnerabilities
- Foreseer Electrical Power Monitoring System4 vulnerabilities
- Ups Companion4 vulnerabilities
- 9Px Ups3 vulnerabilities
- Elcsoft3 vulnerabilities
- Foreseer3 vulnerabilities
- Foreseer Reporting Software (Frs)3 vulnerabilities
- Intelligent Power Manager Infrastructure (IPM Infrastructure)3 vulnerabilities
- PADM3 vulnerabilities
- UPS Companion Software3 vulnerabilities
- Easysoft Software2 vulnerabilities
- Eaton Brightlayer Software Suite (Blss)2 vulnerabilities
- G4 PDU2 vulnerabilities
- Hmisoft Vu32 vulnerabilities
- Proview2 vulnerabilities
- 5P 8501 vulnerabilities
- 9000X1 vulnerabilities
- 9000X Programming And Configuration Software1 vulnerabilities
- Eamaxx Series Epdu1 vulnerabilities
- Eamxxx Series Epdu1 vulnerabilities
- Easy E4 Ac 8Re1P1 vulnerabilities
- Easy Box E4 Ac11 vulnerabilities
- Easy Box E4 Dc11 vulnerabilities
- Easy Box E4 Uc11 vulnerabilities
- Easy E4 Ac 12Rc1P1 vulnerabilities
- Easy E4 Ac 12Rcx1P1 vulnerabilities
- Easy E4 Ac 16Re1P1 vulnerabilities
- Easy E4 Dc 12Tc1P1 vulnerabilities
- Easy E4 Dc 12Tcx1P1 vulnerabilities
- Easy E4 Dc 16Te1P1 vulnerabilities
- Easy E4 Dc 4Pe1P1 vulnerabilities
- Easy E4 Dc 6Ae1P1 vulnerabilities
- Easy E4 Dc 8Te1P1 vulnerabilities
- Easy E4 Uc 12Rc1P1 vulnerabilities
- Easy E4 Uc 12Rcx1P1 vulnerabilities
- Easy E4 Uc 16Re11 vulnerabilities
- Easy E4 Uc 16Re1P1 vulnerabilities
- Easy E4 Uc 8Re1P1 vulnerabilities
- Easye41 vulnerabilities
- Eaton Elcsoft1 vulnerabilities
- Eaton Galileo Software1 vulnerabilities
- Eaton Intelligent Power Protector (Ipp)1 vulnerabilities
- Eaton IPP Software1 vulnerabilities
- Eaton UPS Companion Software1 vulnerabilities
- Eaton Xcomfort ECI1 vulnerabilities
CVE-2018-16158eatonpower_xpert_meter_4000_firmware+2
EPSS score34.93%
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins (to uid 0) via the PubkeyAuthentication option.CVE-2018-9281eaton9px_ups_firmwareEPSS score0.43%
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable to Reflected Cross-Site Scripting vulnerabilities. This flaw could be triggered by driving an administrator logged into the Eaton application to a specially crafted web page. This attack could be done silently.CVE-2018-9279eaton9px_ups_firmwareEPSS score1.04%
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage.CVE-2018-9280eaton9px_ups_firmwareEPSS score1.04%
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwords of the read and write users could be retrieved by browsing the source code of the webpage.CVE-2018-7511eatoneaton elcsoft+1EPSS score2.02%
In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow remote execution of arbitrary code.CVE-2018-12031eatonintelligent_power_managerEPSS score19.48%
Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.CVE-2018-8847eaton9000x_firmware+1EPSS score6.75%
Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.CVE-2021-23280eatonintelligent_power_manager+3EPSS score0.87%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.CVE-2021-23288eatonintelligent_power_protectorEPSS score0.29%
The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Protector versions prior to 1.69.CVE-2021-23276eatonintelligent_power_manager+3EPSS score0.79%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.CVE-2021-23277eatonintelligent_power_manager+3EPSS score0.96%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.CVE-2021-23278eatonintelligent_power_manager+3EPSS score1.01%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.CVE-2021-23279eatonintelligent_power_manager+3EPSS score27.09%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.CVE-2021-23285eatonintelligent_power_manager+1EPSS score0.42%
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.CVE-2021-23287eatonintelligent_power_manager+1EPSS score0.46%
The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70.CVE-2021-23284eatonintelligent_power_manager_infrastructure+1EPSS score0.50%
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.CVE-2021-23283eatoneaton intelligent power protector (ipp)+1EPSS score0.53%
Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.CVE-2021-23282eatonintelligent power manager (ipm)EPSS score8.33%
Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The
vulnerability exists due to insufficient validation of input from certain resources by the IPM software.
The attacker would need access to the local Subnet and an administrator interaction to compromise
the systemCVE-2021-23281eatonintelligent_power_manager+1EPSS score2.23%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code.CVE-2021-23286eatonintelligent_power_manager+1EPSS score0.42%
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.