Vendor
Eaton
59 known vulnerabilities.
Eaton at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 3 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 3 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 5 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 1 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 4 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 1 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 2 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 1 | 0 |
| Feb 2025 | 3 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Medium max 7.8
Eaton UPS Companion Software: Schwachstelle ermöglicht Codeausführung
Ein lokaler Angreifer kann eine Schwachstelle in Eaton UPS Companion Software ausnutzen, um beliebigen Programmcode auszuführen.
first Dec 23, 2025 -
High max 8.6WID-SEC-2025-2926 2 CVEs
Eaton UPS Companion Software: Mehrere Schwachstellen ermöglichen Codeausführung
Ein Angreifer kann mehrere Schwachstellen in Eaton UPS Companion Software ausnutzen, um beliebigen Programmcode auszuführen.
-
Medium max 5.7
Eaton Power Distribution Unit: Mehrere Schwachstellen ermöglichen Manipulation von Dateien
Ein entfernter authentisierter Angreifer kann mehrere Schwachstellen in der Eaton Power Distribution Unit ausnutzen, um Dateien zu manipulieren und eine Man-in-the-Middle-Attacke durchzuführen.
first Aug 5, 2025 -
Highfirst Apr 3, 2016
-
High
Eaton Lighting Systems EG2 Web Control Authentication Bypass Vulnerabilities
first Dec 3, 2016
59 results · Feed
-
Medium 5.9
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exp…
-
High 7.5
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through …
-
High 7.5
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to ca…
-
High 8.8
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could a…
-
High 8.3
Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could a…
-
High 8.6
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an una…
-
High 7.8
Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to …
-
Medium 5.9
A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header wa…
-
Medium 5.7
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attack…
-
Medium 6.5
Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface logi…
-
Medium 6.0
Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attac…
-
Medium 6.1
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an …
-
Medium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentia…
-
High 7.8
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software…
-
Medium 6.7
Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution…
-
High 8.6
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code exe…
-
High 8.8CVE-2025-59886 Public exploit
Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker wi…
-
High 7.3
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths…
-
High 7.1
The privileged user could log in without sufficient credentials after enabling an application protocol. This security i…
-
High 8.3
Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This se…
-
High 8.6
Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of …
-
Medium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing th…
-
Medium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing th…
-
Medium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentia…
-
Medium 5.6
Improper cookie attributes in Foreseer Reporting Software (FRS)
Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest v…
-
Medium 6.3
Insecure storage of connection strings in FRS
The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.1…
-
Medium 6.7
Improper Input Validation in Foreseer Reporting Software (FRS)
The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arbitrary JavaScript in a browser context for all the interacting users. This security issue has been p…
-
High 8.4
An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card.…
-
Medium 6.7
Improper access control mechanism in IPP
IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems.
-
Medium 5.1
Insufficient verification of authenticity in IPP
IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to accept invalid data.
-
Medium 5.2
Stored Cross-site Scripting reported in Intelligent Power Manager v1
Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of input from certain resources by the IPM software. The attacker would need access to the local Subnet a…
-
Medium 5.6
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the to…
-
Medium 6.3
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes s…
-
Medium 6.7
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the inp…
-
Medium 5.9
Insecure storage of password in easySoft
Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized ac…
-
Medium 6.8
Weak encoding vulnerability in easyE4
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported t…
-
Medium 4.7
Security issue in SMP Gateway automation platform
Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP devi…
-
High 8.1
Unrestricted file upload in Eaton Foreseer EPMS
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. …
-
Medium 5.2
Security issues in Eaton Intelligent Power Protector (IPP)
Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.
-
Medium 5.7
Security issues in Eaton Intelligent Power Manager Infrastructure
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0p…