Vendor
Eaton
59 known vulnerabilities.
Products
24 results · Clear filters · Feed
-
High 7.5
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through …
-
High 7.5
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to ca…
-
High 8.8
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could a…
-
High 8.3
Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could a…
-
High 8.6
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an una…
-
High 7.8
Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to …
-
High 7.8
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software…
-
High 8.6
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code exe…
-
High 8.8CVE-2025-59886 Public exploit
Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker wi…
-
High 7.3
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths…
-
High 7.1
The privileged user could log in without sufficient credentials after enabling an application protocol. This security i…
-
High 8.3
Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This se…
-
High 8.6
Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of …
-
High 8.4
An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card.…
-
High 8.1
Unrestricted file upload in Eaton Foreseer EPMS
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. …
-
High 8.0
Arbitrary File upload
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious cod…
-
High 8.3
Improper Neutralization of Directives in Dynamically Evaluated Code
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/…
-
High 8.0CVE-2021-23279 EPSS 28%
Arbitrary File delete
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker ca…
-
High 7.1
Improper Neutralization of Special Elements used in an SQL Command
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users…
-
High 8.7
Arbitrary File delete
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action remov…
-
High 7.8
DLL Hijacking
A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replacing the required DLLs with malicious DLLs when the software try to load vci11un6.DLL and cinpl.DLL.
-
High 8.8
Command injection via specially crafted file name during config file upload
Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading th…
-
High 7.8
Incorrect privilege assignment allowing non-admin users to upload config files
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the sys…
-
High 8.3CVE-2020-6650 Public exploit
Arbitrary code execution through “Update Manager” Class
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software …