Eaton vulnerabilities
We track 20 vulnerabilities in Eaton products across 16 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Eaton vulnerabilities
- 7.5 High severity
easyE4: Weak Password Requirements
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials.
- 7.5 High severity
easyE4: Authentication Bypass by Capture-replay
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
- 8.8 High severity
PADM: Improper Neutralization of Special Elements used in an OS Command
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.
- 8.3 High severity
PADM: Improper Neutralization of Special Elements used in an OS Command
Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.
- 8.6 High severity
PADM: Improper Neutralization of Special Elements used in an SQL Command
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
- 9.9 Critical severity
IPP software: Uncontrolled Search Path Element
Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package. This security issue has been fixed in the latest version of Eato
- 7.1 High severity
IPP software: Improperly Implemented Security Check for Standard
A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web‑based attacks. This security issue has been fixed in the latest version o
- 7.4 High severity
IPP Software: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eat
- 7.5 High severity
IPP Software: Improper Restriction of Excessive Authentication Attempts
Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting controls. This security issue has been fixed in the latest version of Eaton IPP which is available o
- 7.2 High severity
Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it…
Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command execution. This security iss
- 7.8 High severity
UPS Companion software: Uncontrolled Search Path Element
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the E
- 8.6 High severity
Eaton UPS Companion Software: Uncontrolled Search Path Element
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of EUC which is avail
- 8.8 High severity
Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could…
Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirement
- 7.3 High severity
Eaton Galileo Software: Improper Limitation of a Pathname to a Restricted Directory
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the late
- 7.1 High severity
Eaton Brightlayer Software Suite (BLSS): Missing Authentication for Critical Functionality
The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
- 8.3 High severity
Eaton Brightlayer Software Suite (BLSS): Unrestricted Upload of File with Dangerous Type
Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
- 8.6 High severity
Eaton IPP software: Uncontrolled Search Path Element
Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of IPP which is available on th
- 8.4 High severity
Network M2: Improper Neutralization of Special Elements used in an OS Command
An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been reso
- 8.1 High severity
Foreseer: Insufficiently Protected Credentials
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. How
- 9.8 Critical severity
Foreseer EPMS: Unrestricted Upload of File with Dangerous Type
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A