Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2025-59886 EUVD-2025-204794GHSA-jj64-h3xq-fcxh

Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to…

Published Dec 23, 2025 · Updated Dec 23, 2025 · Assigned by Eaton

Vendor: Eaton Product: Eaton xComfort ECI

Description

Improper input validation at one of the endpoints of Eaton xComfort ECI's

web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity
standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the
product. Upon retirement or end of support, there will be no new security updates, non-security
updates, or paid assisted support options, or online technical content updates.

Affected products

VendorProductAffectedFixed
Eaton Eaton xComfort ECI ≤ All versions —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References