https://vulnogram.org/ Most recent CVEs assigned by Eaton (eaton). https://vulnogram.org/seaview/icons/eaton.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-22622 https://vulnogram.org/CVE-2026-22622 Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device. High Unsupported When Assigned Thu, 30 Jul 2026 10:21:17 GMT https://vulnogram.org/CVE-2026-22621 https://vulnogram.org/CVE-2026-22621 Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment. High Unsupported When Assigned Thu, 30 Jul 2026 10:16:28 GMT https://vulnogram.org/CVE-2026-22620 https://vulnogram.org/CVE-2026-22620 Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device. High Network Exploitable Unsupported When Assigned Thu, 30 Jul 2026 10:11:37 GMT https://vulnogram.org/CVE-2026-22619 https://vulnogram.org/CVE-2026-22619 Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package. This security issue has been fixed in the latest versi… High Thu, 16 Apr 2026 05:26:48 GMT https://vulnogram.org/CVE-2026-22618 https://vulnogram.org/CVE-2026-22618 A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web‑based attacks. This security issue has been fixed in the latest… Medium Network Exploitable Thu, 16 Apr 2026 05:11:06 GMT https://vulnogram.org/CVE-2026-22617 https://vulnogram.org/CVE-2026-22617 Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest vers… Medium Thu, 16 Apr 2026 05:02:07 GMT https://vulnogram.org/CVE-2026-22616 https://vulnogram.org/CVE-2026-22616 Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting controls. This security issue has been fixed in the latest version of Eaton IPP which is a… Medium Network Exploitable Thu, 16 Apr 2026 04:54:48 GMT https://vulnogram.org/CVE-2026-22615 https://vulnogram.org/CVE-2026-22615 Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command execution. This se… Medium Thu, 16 Apr 2026 04:45:58 GMT https://vulnogram.org/CVE-2026-22614 https://vulnogram.org/CVE-2026-22614 The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper wit… Medium Tue, 10 Mar 2026 10:24:35 GMT https://vulnogram.org/CVE-2026-22613 https://vulnogram.org/CVE-2026-22613 The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version o… Medium Mon, 09 Feb 2026 05:39:22 GMT https://vulnogram.org/CVE-2025-67450 https://vulnogram.org/CVE-2025-67450 Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is availabl… High Fri, 26 Dec 2025 06:59:41 GMT https://vulnogram.org/CVE-2025-59888 https://vulnogram.org/CVE-2025-59888 Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the file system. This security issue has been fixed in the latest version of EUC which is availa… Medium Fri, 26 Dec 2025 06:53:33 GMT https://vulnogram.org/CVE-2025-59887 https://vulnogram.org/CVE-2025-59887 Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of EUC whic… High Fri, 26 Dec 2025 06:48:08 GMT https://vulnogram.org/CVE-2025-59886 https://vulnogram.org/CVE-2025-59886 Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our r… High Unsupported When Assigned Tue, 23 Dec 2025 11:31:31 GMT https://vulnogram.org/CVE-2025-59890 https://vulnogram.org/CVE-2025-59890 Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed i… High Thu, 27 Nov 2025 10:48:41 GMT https://vulnogram.org/CVE-2025-48397 https://vulnogram.org/CVE-2025-48397 The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004). High Mon, 03 Nov 2025 08:28:53 GMT https://vulnogram.org/CVE-2025-48396 https://vulnogram.org/CVE-2025-48396 Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004). High Mon, 03 Nov 2025 07:57:22 GMT https://vulnogram.org/CVE-2025-59889 https://vulnogram.org/CVE-2025-59889 Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of IPP which is avail… High Tue, 14 Oct 2025 05:11:27 GMT https://vulnogram.org/CVE-2025-48395 https://vulnogram.org/CVE-2025-48395 An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on th… Medium Fri, 05 Sep 2025 07:05:18 GMT https://vulnogram.org/CVE-2025-48394 https://vulnogram.org/CVE-2025-48394 An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton do… Medium Wed, 06 Aug 2025 15:25:41 GMT https://vulnogram.org/CVE-2025-48393 https://vulnogram.org/CVE-2025-48393 The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version o… Medium Wed, 06 Aug 2025 15:25:17 GMT https://vulnogram.org/CVE-2025-22493 https://vulnogram.org/CVE-2025-22493 Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the… Medium Wed, 05 Mar 2025 08:53:59 GMT https://vulnogram.org/CVE-2025-22492 https://vulnogram.org/CVE-2025-22492 The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest vers… Medium Fri, 28 Feb 2025 08:29:33 GMT https://vulnogram.org/CVE-2025-22491 https://vulnogram.org/CVE-2025-22491 The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arbitrary JavaScript in a browser context for all the interacting users. This security issue h… Medium Fri, 28 Feb 2025 08:24:21 GMT https://vulnogram.org/CVE-2025-22495 https://vulnogram.org/CVE-2025-22495 An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has… High Unsupported When Assigned Mon, 24 Feb 2025 16:27:46 GMT https://vulnogram.org/CVE-2022-33862 https://vulnogram.org/CVE-2022-33862 IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems. Medium Mon, 25 Nov 2024 08:54:39 GMT https://vulnogram.org/CVE-2022-33861 https://vulnogram.org/CVE-2022-33861 IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to accept invalid data. Medium Mon, 25 Nov 2024 08:50:04 GMT https://vulnogram.org/CVE-2021-23282 https://vulnogram.org/CVE-2021-23282 Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of input from certain resources by the IPM software. The attacker would need access to the local… Medium Mon, 25 Nov 2024 08:36:19 GMT https://vulnogram.org/CVE-2024-31416 https://vulnogram.org/CVE-2024-31416 The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of these input fields were not checking the length and bounds of the entered value. The exploit… Medium Fri, 13 Sep 2024 16:48:32 GMT https://vulnogram.org/CVE-2024-31415 https://vulnogram.org/CVE-2024-31415 The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host ma… Medium Fri, 13 Sep 2024 16:48:12 GMT https://vulnogram.org/CVE-2024-31414 https://vulnogram.org/CVE-2024-31414 The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to… Medium Fri, 13 Sep 2024 16:46:51 GMT https://vulnogram.org/CVE-2023-43777 https://vulnogram.org/CVE-2023-43777 Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauth… Medium Tue, 17 Oct 2023 12:49:04 GMT https://vulnogram.org/CVE-2023-43776 https://vulnogram.org/CVE-2023-43776 Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when e… Medium Tue, 17 Oct 2023 12:35:09 GMT https://vulnogram.org/CVE-2023-43775 https://vulnogram.org/CVE-2023-43775 Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the… Medium Tue, 26 Sep 2023 13:50:13 GMT https://vulnogram.org/CVE-2022-33859 https://vulnogram.org/CVE-2022-33859 A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical… High Fri, 28 Oct 2022 01:15:03 GMT https://vulnogram.org/CVE-2021-23283 https://vulnogram.org/CVE-2021-23283 Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP… Medium Tue, 19 Apr 2022 20:26:41 GMT https://vulnogram.org/CVE-2021-23286 https://vulnogram.org/CVE-2021-23286 Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all versi… Medium Mon, 18 Apr 2022 16:20:33 GMT https://vulnogram.org/CVE-2021-23284 https://vulnogram.org/CVE-2021-23284 Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infra… Medium Mon, 18 Apr 2022 16:20:32 GMT https://vulnogram.org/CVE-2021-23285 https://vulnogram.org/CVE-2021-23285 Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM In… Low Mon, 18 Apr 2022 16:20:31 GMT https://vulnogram.org/CVE-2021-23288 https://vulnogram.org/CVE-2021-23288 The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent… Medium Fri, 01 Apr 2022 22:17:34 GMT https://vulnogram.org/CVE-2021-23287 https://vulnogram.org/CVE-2021-23287 The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70. Medium Fri, 01 Apr 2022 22:17:33 GMT https://vulnogram.org/CVE-2021-23280 https://vulnogram.org/CVE-2021-23280 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a mali… High Tue, 13 Apr 2021 18:04:34 GMT https://vulnogram.org/CVE-2021-23277 https://vulnogram.org/CVE-2021-23277 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scri… High Tue, 13 Apr 2021 18:04:16 GMT https://vulnogram.org/CVE-2021-23281 https://vulnogram.org/CVE-2021-23281 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a… Critical Network Exploitable Tue, 13 Apr 2021 18:03:54 GMT https://vulnogram.org/CVE-2021-23279 https://vulnogram.org/CVE-2021-23279 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An at… High Tue, 13 Apr 2021 18:03:26 GMT https://vulnogram.org/CVE-2021-23276 https://vulnogram.org/CVE-2021-23276 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to… High Tue, 13 Apr 2021 18:03:08 GMT https://vulnogram.org/CVE-2021-23278 https://vulnogram.org/CVE-2021-23278 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with act… High Tue, 13 Apr 2021 18:02:51 GMT https://vulnogram.org/CVE-2020-6656 https://vulnogram.org/CVE-2020-6656 Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70… Medium Thu, 07 Jan 2021 17:22:15 GMT https://vulnogram.org/CVE-2020-6655 https://vulnogram.org/CVE-2020-6655 The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file… Medium Thu, 07 Jan 2021 17:21:26 GMT https://vulnogram.org/CVE-2020-6654 https://vulnogram.org/CVE-2020-6654 A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replacing the required DLLs with malicious DLLs when the software try to load vci11un6.DLL and ci… High Wed, 30 Sep 2020 20:36:20 GMT