What is CVE-2025-59886?

CVE-2025-59886 is a high-severity vulnerability in Eaton Xcomfort Eci, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2025-12-23.

How severe is CVE-2025-59886?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2025-59886 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Eaton Xcomfort Eci

CVE-2025-59886

Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.003 (20.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Eaton Xcomfort Eci — versions 0
Eaton Xcomfort_ethernet_communication_interface

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

mdunfjeld/cve-2025-59886

References

CybersecurityCOE@eaton.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-59886?: CVE-2025-59886 is a high-severity vulnerability in Eaton Xcomfort Eci, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2025-12-23.
How severe is CVE-2025-59886?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-59886 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.