Eaton
63 CVEs across 121 Eaton products. Browse Eaton vulnerabilities, severities, and proof-of-concept exploits.
Eaton products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22622 | High | 8.8 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate pr… |
CVE-2026-22621 | High | 8.3 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to e… |
CVE-2026-22620 | High | 8.6 | 2026-07-30 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass a… |
CVE-2026-22619 | High | 7.8 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker… |
CVE-2026-22618 | Medium | 5.9 | 2026-04-16 | A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potent… |
CVE-2026-22617 | Medium | 5.7 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit i… |
CVE-2026-22616 | Medium | 6.5 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting… |
CVE-2026-22615 | Medium | 6.0 | 2026-04-16 | Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to… |
CVE-2026-22614 | Medium | 6.1 | 2026-03-10 | The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and th… |
CVE-2026-22613 | Medium | 5.7 | 2026-02-09 | The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Ma… |
CVE-2025-67450 | High | 7.8 | 2025-12-26 | Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code… |
CVE-2025-59888 | Medium | 6.7 | 2025-12-26 | Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the … |
CVE-2025-59887 | High | 8.6 | 2025-12-26 | Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to… |
CVE-2025-59886 | High | 8.8 | 2025-12-23 | Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device execut… |
CVE-2025-59890 | High | 7.3 | 2025-11-27 | Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with… |
CVE-2025-48397 | High | 7.1 | 2025-11-03 | The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script… |
CVE-2025-48396 | High | 8.3 | 2025-11-03 | Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the lates… |
CVE-2025-59889 | High | 8.6 | 2025-10-14 | Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the softw… |
CVE-2025-48395 | Medium | 4.7 | 2025-09-05 | An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI… |
CVE-2025-48394 | Medium | 4.7 | 2025-08-06 | An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI… |
CVE-2025-48393 | Medium | 5.7 | 2025-08-06 | The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Ma… |
CVE-2025-22493 | Medium | 5.6 | 2025-03-05 | Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being… |
CVE-2025-22492 | Medium | 6.3 | 2025-02-28 | The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrat… |
CVE-2025-22491 | Medium | 6.7 | 2025-02-28 | The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arb… |
CVE-2025-22495 | High | 8.4 | 2025-02-24 | An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated h… |
CVE-2022-33862 | Medium | 6.7 | 2024-11-25 | IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems. |
CVE-2022-33861 | Medium | 5.1 | 2024-11-25 | IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to accept invalid data. |
CVE-2021-23282 | Medium | 5.2 | 2024-11-25 | Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of in… |
CVE-2024-31416 | Medium | 5.6 | 2024-09-13 | The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of th… |
CVE-2024-31415 | Medium | 6.3 | 2024-09-13 | The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user manageme… |
CVE-2024-31414 | Medium | 6.7 | 2024-09-13 | The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton… |
CVE-2023-43777 | Medium | 5.9 | 2023-10-17 | Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. T… |
CVE-2023-43776 | Medium | 6.8 | 2023-10-17 | Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the… |
CVE-2023-43775 | Medium | 4.7 | 2023-09-27 | Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platf… |
CVE-2022-33859 | High | 8.1 | 2022-10-28 | A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduc… |
CVE-2021-23283 | Medium | 5.2 | 2022-04-19 | Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient valida… |
CVE-2021-23286 | Medium | 5.7 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This i… |
CVE-2021-23285 | Low | 3.1 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scriptin… |
CVE-2021-23284 | Medium | 5.7 | 2022-04-18 | Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting v… |
CVE-2021-23288 | Medium | 5.6 | 2022-04-01 | The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet… |
CVE-2021-23287 | Medium | 5.6 | 2022-04-01 | The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (I… |
CVE-2021-23281 | Critical | 10.0 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the da… |
CVE-2021-23280 | High | 8.0 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to… |
CVE-2021-23279 | High | 8.0 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validati… |
CVE-2021-23278 | High | 8.7 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation… |
CVE-2021-23277 | High | 8.3 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax… |
CVE-2021-23276 | High | 7.1 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to explo… |
CVE-2020-6656 | Medium | 5.8 | 2021-01-07 | Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execu… |
CVE-2020-6655 | Medium | 5.8 | 2021-01-07 | The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malic… |
CVE-2020-6654 | High | 7.8 | 2020-09-30 | A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replac… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-6652 | High | 7.8 | 2020-05-07 | Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration… |
CVE-2020-6651 | High | 8.8 | 2020-05-07 | Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attacker… |
CVE-2020-10639 | High | 7.8 | 2020-04-15 | Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted i… |
CVE-2020-10637 | Medium | 5.5 | 2020-04-15 | Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted i… |
CVE-2020-6650 | High | 8.3 | 2020-03-23 | UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax bef… |
CVE-2020-7915 | Medium | 4.8 | 2020-01-22 | An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator. |
CVE-2019-5625 | High | 7.1 | 2019-05-22 | The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the… |
CVE-2018-9281 | High | 8.8 | 2018-10-24 | An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vu… |
CVE-2018-9280 | Medium | 4.9 | 2018-10-24 | An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance c… |
CVE-2018-9279 | Medium | 4.9 | 2018-10-24 | An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the pas… |
CVE-2018-16158 | Critical | 9.8 | 2018-08-30 | Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not proper… |
CVE-2018-8847 | Critical | 9.8 | 2018-07-13 | Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution. |
CVE-2018-12031 | Critical | 9.8 | 2018-06-07 | Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the f… |
CVE-2018-7511 | Medium | 5.3 | 2018-03-20 | In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow rem… |
CVE-2016-9368 | High | 7.5 | 2017-03-14 | An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform resource locator (URL… |
CVE-2016-9357 | Medium | 5.3 | 2017-02-13 | An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 201… |
CVE-2016-4512 | High | 7.3 | 2016-07-03 | Stack-based buffer overflow in ELCSimulator in Eaton ELCSoft 2.4.01 and earlier allows remote attackers to execute arbitrary code via a long packet. |
CVE-2016-4509 | Medium | 6.0 | 2016-07-03 | Heap-based buffer overflow in elcsoft.exe in Eaton ELCSoft 2.4.01 and earlier allows remote authenticated users to execute arbitrary code via a crafted file. |
CVE-2015-6471 | Medium | 5.3 | 2015-12-23 | Eaton Cooper Power Systems ProView 4.x and 5.x before 5.1 on Form 6 controls and Idea and IdeaPLUS relays does not properly initialize padding fields in Ethern… |
CVE-2014-9196 | | 2015-07-20 | Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values… | |
CVE-2008-6816 | | 2009-05-28 | Eaton MGEOPS Network Shutdown Module before 3.10 Build 13 allows remote attackers to execute arbitrary code by adding a custom action to the MGE frontend via p… |