Eaton easySoft versions prior to 8.46 improperly validate TLS certificates from easyE4 devices, allowing a network-adjacent attacker to perform man-in-the-middle attacks. This vulnerability could enable interception or modification of communications between easySoft and easyE4 devices.
CVE-2026-41021 affects Eaton easyE4 versions prior to 2.46 and involves weak password requirements. This weakness allows an attacker who has obtained password hashes, potentially via another vulnerability (CVE-2026-41020), to perform offline password-guessing attacks and recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5. Eaton has fixed this issue in version 2.46.
CVE-2026-41020 is an authentication bypass vulnerability in Eaton easyE4 devices caused by the use of a static nonce during authentication. This flaw allows an unauthenticated attacker who has captured valid authentication traffic to replay it and gain unauthorized access to the device. The vulnerability affects versions prior to 2.46. A fix is available in version 2.46. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-22622 is a high-severity vulnerability in Eaton's Tripp Lite PADM firmware involving improper input validation in a session management interface. This flaw could allow an authenticated user to perform OS command injection, leading to privilege escalation and unrestricted device access. No patch or official remediation guidance is currently available.
CVE-2026-22621 is a high-severity vulnerability in Eaton's Tripp Lite Series PADM firmware. It involves improper input validation in a session management interface that could allow an authenticated administrator to execute arbitrary OS commands within a restricted environment. This vulnerability is classified as CWE-78, OS command injection. No patch or official remediation guidance is currently provided by the vendor.
CVE-2026-22620 is a high severity SQL injection vulnerability in the authentication component of Eaton's Tripp Lite PADM firmware. This flaw allows an unauthenticated remote attacker to bypass authentication and gain privileged user access to the device. The vulnerability arises from improper input validation of special elements used in SQL commands. No specific affected versions or patches have been disclosed yet.
Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download center.
A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web‑based attacks. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.
Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting controls. This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.
Due to improper
input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is
possible for an attacker with admin privileges and access to the local system to
inject malicious code resulting in arbitrary command execution. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host
machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre.
CVE-2026-22613 is a medium severity vulnerability affecting Eaton Network M3 devices, caused by improper certificate validation during firmware upgrades via command shell. This flaw allows an attacker with high privileges and requiring user interaction to potentially conduct a man-in-the-middle (MitM) attack, compromising confidentiality and partially impacting integrity and availability. The vulnerability arises from insecure server identity checks, enabling interception or manipulation of firmware upgrade processes. Eaton has addressed this issue in the latest firmware version available on their download center. European organizations using Eaton Network M3 devices should prioritize updating to the patched firmware to mitigate risks. The vulnerability is remotely exploitable with low attack complexity but requires privileged access and user interaction. Countries with significant industrial and critical infrastructure sectors relying on Eaton products, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves applying the firmware update, restricting access to command shell interfaces, and monitoring network traffic for suspicious activity during firmware upgrades.
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package
could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the
file system. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
Improper input validation at one of the endpoints of Eaton xComfort ECI's
web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity
standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the
product. Upon retirement or end of support, there will be no new security updates, non-security
updates, or paid assisted support options, or online technical content updates.
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.
The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
