Eaton

Latest CVEs · RSS

• CVE-2026-22622 2026-07-30 · CVSS 8.8
  Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate pri
• CVE-2026-22621 2026-07-30 · CVSS 8.3
  Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to ex
• CVE-2026-22620 2026-07-30 · CVSS 8.6
  Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass au
• CVE-2026-22619 2026-04-16 · CVSS 7.8
  Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker w
• CVE-2026-22618 2026-04-16 · CVSS 5.9
  A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potenti
• CVE-2026-22617 2026-04-16 · CVSS 5.7
  Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it
• CVE-2026-22616 2026-04-16 · CVSS 6.5
  Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting
• CVE-2026-22615 2026-04-16 · CVSS 6.0
  Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to t
• CVE-2026-22614 2026-03-10 · CVSS 6.1
  The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the
• CVE-2026-22613 2026-02-09 · CVSS 5.7
  The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man
• CVE-2025-67450 2025-12-26 · CVSS 7.8
  Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code e
• CVE-2025-59888 2025-12-26 · CVSS 6.7
  Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the
• CVE-2025-59887 2025-12-26 · CVSS 8.6
  Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to
• CVE-2025-59886 2025-12-23 · CVSS 8.8
  Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executi
• CVE-2025-59890 2025-11-27 · CVSS 7.3
  Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with l
• CVE-2025-48397 2025-11-03 · CVSS 7.1
  The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script
• CVE-2025-48396 2025-11-03 · CVSS 8.3
  Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest
• CVE-2025-59889 2025-10-14 · CVSS 8.6
  Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the softwa
• CVE-2025-48395 2025-09-05 · CVSS 4.7
  An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. T
• CVE-2025-48394 2025-08-06 · CVSS 4.7
  An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. T
• CVE-2025-48393 2025-08-06 · CVSS 5.7
  The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man
• CVE-2025-22493 2025-03-05 · CVSS 5.6
  Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being t
• CVE-2025-22492 2025-02-28 · CVSS 6.3
  The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrati
• CVE-2025-22491 2025-02-28 · CVSS 6.7
  The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arbi
• CVE-2025-22495 2025-02-24 · CVSS 8.4
  An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated hi