Eaton vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-41021 Eaton easyE4 uses an insufficiently strong password policy.High 7.5 · Oct 27, 2026
• CVE-2026-41020 Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay aHigh 7.5 · Oct 27, 2026
• CVE-2026-22622 Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate priHigh 8.8 · Jul 30, 2026
• CVE-2026-22621 Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to exHigh 8.3 · Jul 30, 2026
• CVE-2026-22620 Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass auHigh 8.6 · Jul 30, 2026
• CVE-2026-22619 Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker wHigh 7.8 · Apr 16, 2026
• CVE-2025-67450 Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code eHigh 7.8 · Dec 26, 2025
• CVE-2025-59887 Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to High 8.6 · Dec 26, 2025
• CVE-2025-59886 Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executiHigh 8.8 · Dec 23, 2025
• CVE-2025-59890 Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with lHigh 7.3 · Nov 27, 2025
• CVE-2025-48397 The privileged user could log in without sufficient credentials after enabling an application protocol.High 7.1 · Nov 3, 2025
• CVE-2025-48396 Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS.High 8.3 · Nov 3, 2025
• CVE-2025-59889 Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the softwaHigh 8.6 · Oct 14, 2025
• CVE-2025-22495 An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card.High 8.4 · Feb 24, 2025
• CVE-2022-33859 A security vulnerability was discovered in the Eaton Foreseer EPMS software.High 8.1 · Oct 27, 2022
• CVE-2021-23281 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability.Critical 10 · Apr 13, 2021
• CVE-2021-23280 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability.High 8 · Apr 13, 2021
• CVE-2021-23279 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validatioHigh 8 · Apr 13, 2021
• CVE-2021-23278 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation High 8.7 · Apr 13, 2021
• CVE-2021-23277 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability.High 8.3 · Apr 13, 2021
• CVE-2021-23276 Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection.High 7.1 · Apr 13, 2021
• CVE-2020-6654 A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replaciHigh 7.8 · Sep 30, 2020
• CVE-2020-6652 Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration fHigh 7.8 · May 7, 2020
• CVE-2020-6651 Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackersHigh 8.8 · May 7, 2020
• CVE-2020-10639 Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues.High 7.8 · Apr 15, 2020