CveMateVulnerability intelligence

Eaton vulnerabilities, page 2

72 vulnerabilities

Known vulnerabilities in Eaton products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 76 products.

CVE-2015-6471eatonproview10y ago23-12-2015 02:00

Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data.CVE-2016-9368eatonxcomfort_ethernet_communication_interface9y ago14-03-2017 09:02

An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access files without authenticating.CVE-2016-9357eatoneamaxx_series_epdu_firmware+49y ago13-02-2017 21:00

An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 2015, EMAxxx prior to January 31, 2014, EAMAxx prior to January 31, 2014, EMAAxx prior to January 31, 2014, and ESWAxx prior to January 31, 2014. An unauthenticated attacker may be able to access configuration files with a specially crafted URL (Path Traversal).CVE-2016-4512eatonelcsoft10y ago03-07-2016 14:00

Stack-based buffer overflow in ELCSimulator in Eaton ELCSoft 2.4.01 and earlier allows remote attackers to execute arbitrary code via a long packet.CVE-2016-4509eatonelcsoft10y ago03-07-2016 14:00

Heap-based buffer overflow in elcsoft.exe in Eaton ELCSoft 2.4.01 and earlier allows remote authenticated users to execute arbitrary code via a crafted file.CVE-2025-59887eatoneaton ups companion software+110mo ago26-12-2025 06:48

Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.CVE-2025-59888eatonups_companion+110mo ago26-12-2025 06:53

Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the file system. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.CVE-2025-59886eatoneaton xcomfort eci10mo ago23-12-2025 11:31

Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.CVE-2025-59889eatoneaton ipp software1y ago14-10-2025 05:11

Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of IPP which is available on the Eaton download center.CVE-2025-59890eatoneaton galileo software10mo ago27-11-2025 10:48

Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.CVE-2025-48397eatoneaton brightlayer software suite (blss)11mo ago03-11-2025 08:28

The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).CVE-2025-48394eatong4 pdu1y ago06-08-2025 15:25

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center.CVE-2025-48395eatonnmc g21y ago05-09-2025 07:05

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center.CVE-2025-48396eatoneaton brightlayer software suite (blss)11mo ago03-11-2025 07:57

Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).CVE-2025-48393eatong4 pdu1y ago06-08-2025 15:25

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton G4 PDU which is available on the Eaton download center.CVE-2025-67450eatonups_companion+110mo ago26-12-2025 06:59

Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.CVE-2025-22495eatonnetwork m21y ago24-02-2025 16:27

An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. Note - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.CVE-2025-22492eatonforeseer reporting software (frs)1y ago28-02-2025 08:29

The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.100 of FRS.CVE-2025-22491eatonforeseer reporting software (frs)1y ago28-02-2025 08:24

The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arbitrary JavaScript in a browser context for all the interacting users. This security issue has been patched in the latest version 1.5.100 of the FRS.CVE-2025-22493eatonforeseer reporting software (frs)1y ago05-03-2025 08:53

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100.