# cve.now: Eaton

The newest entries naming Eaton as an affected vendor (up to 200), of 59 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-41022](https://cve.now/CVE-2026-41022.md): Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. (CVSS 5.9)
- [CVE-2026-41021](https://cve.now/CVE-2026-41021.md): Eaton easyE4 uses an insufficiently strong password policy. (CVSS 7.5)
- [CVE-2026-41020](https://cve.now/CVE-2026-41020.md): Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured… (CVSS 7.5)
- [CVE-2026-22622](https://cve.now/CVE-2026-22622.md): Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated (CVSS 8.8)
- [CVE-2026-22621](https://cve.now/CVE-2026-22621.md): Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated (CVSS 8.3)
- [CVE-2026-22620](https://cve.now/CVE-2026-22620.md): Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote a (CVSS 8.6)
- [CVE-2026-22619](https://cve.now/CVE-2026-22619.md): Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut (CVSS 7.8)
- [CVE-2026-22618](https://cve.now/CVE-2026-22618.md): A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecur (CVSS 5.9)
- [CVE-2026-22617](https://cve.now/CVE-2026-22617.md): Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the c (CVSS 5.7)
- [CVE-2026-22616](https://cve.now/CVE-2026-22616.md): Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffi (CVSS 6.5)
- [CVE-2026-22615](https://cve.now/CVE-2026-22615.md): Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privil (CVSS 6.0)
- [CVE-2026-22614](https://cve.now/CVE-2026-22614.md): The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access (CVSS 6.1)
- [CVE-2026-22613](https://cve.now/CVE-2026-22613.md): The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac (CVSS 5.7)
- [CVE-2025-67450](https://cve.now/CVE-2025-67450.md): Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perf (CVSS 7.8)
- [CVE-2025-59888](https://cve.now/CVE-2025-59888.md): Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with (CVSS 6.7)
- [CVE-2025-59887](https://cve.now/CVE-2025-59887.md): Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker (CVSS 8.6)
- [CVE-2025-59886](https://cve.now/CVE-2025-59886.md): Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t (CVSS 8.8)
- [CVE-2025-59890](https://cve.now/CVE-2025-59890.md): Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead int (CVSS 7.3)
- [CVE-2025-48397](https://cve.now/CVE-2025-48397.md): The privileged user could log in without sufficient credentials after enabling an application protocol. (CVSS 7.1)
- [CVE-2025-48396](https://cve.now/CVE-2025-48396.md): Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. (CVSS 8.3)
- [CVE-2025-59889](https://cve.now/CVE-2025-59889.md): Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the (CVSS 8.6)
- [CVE-2025-48395](https://cve.now/CVE-2025-48395.md): An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited (CVSS 4.7)
- [CVE-2025-48394](https://cve.now/CVE-2025-48394.md): An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited (CVSS 4.7)
- [CVE-2025-48393](https://cve.now/CVE-2025-48393.md): The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac (CVSS 5.7)
- [CVE-2025-22493](https://cve.now/CVE-2025-22493.md): Improper cookie attributes in Foreseer Reporting Software (FRS) (CVSS 5.6)
- [CVE-2025-22492](https://cve.now/CVE-2025-22492.md): Insecure storage of connection strings in FRS (CVSS 6.3)
- [CVE-2025-22491](https://cve.now/CVE-2025-22491.md): Improper Input Validation in Foreseer Reporting Software (FRS) (CVSS 6.7)
- [CVE-2025-22495](https://cve.now/CVE-2025-22495.md): An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. (CVSS 8.4)
- [CVE-2022-33862](https://cve.now/CVE-2022-33862.md): Improper access control mechanism in IPP (CVSS 6.7)
- [CVE-2022-33861](https://cve.now/CVE-2022-33861.md): Insufficient verification of authenticity in IPP (CVSS 5.1)
- [CVE-2021-23282](https://cve.now/CVE-2021-23282.md): Stored Cross-site Scripting reported in Intelligent Power Manager v1 (CVSS 5.2)
- [CVE-2024-31416](https://cve.now/CVE-2024-31416.md): The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, repor (CVSS 5.6)
- [CVE-2024-31415](https://cve.now/CVE-2024-31415.md): The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network manage (CVSS 6.3)
- [CVE-2024-31414](https://cve.now/CVE-2024-31414.md): The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. (CVSS 6.7)
- [CVE-2023-43777](https://cve.now/CVE-2023-43777.md): Insecure storage of password in easySoft (CVSS 5.9)
- [CVE-2023-43776](https://cve.now/CVE-2023-43776.md): Weak encoding vulnerability in easyE4 (CVSS 6.8)
- [CVE-2023-43775](https://cve.now/CVE-2023-43775.md): Security issue in SMP Gateway automation platform (CVSS 4.7)
- [CVE-2022-33859](https://cve.now/CVE-2022-33859.md): Unrestricted file upload in Eaton Foreseer EPMS (CVSS 8.1)
- [CVE-2021-23283](https://cve.now/CVE-2021-23283.md): Security issues in Eaton Intelligent Power Protector (IPP) (CVSS 5.2)
- [CVE-2021-23286](https://cve.now/CVE-2021-23286.md): Security issues in Eaton Intelligent Power Manager Infrastructure (CVSS 5.7)
- [CVE-2021-23284](https://cve.now/CVE-2021-23284.md): Security issues in Eaton Intelligent Power Manager Infrastructure (CVSS 5.7)
- [CVE-2021-23285](https://cve.now/CVE-2021-23285.md): Security issues in Eaton Intelligent Power Manager Infrastructure (CVSS 3.1)
- [CVE-2021-23288](https://cve.now/CVE-2021-23288.md): Security issues in Intelligent Power Protector (CVSS 5.6)
- [CVE-2021-23287](https://cve.now/CVE-2021-23287.md): Security issues in Intelligent Power Manager (IPM 1) (CVSS 5.6)
- [CVE-2021-23280](https://cve.now/CVE-2021-23280.md): Arbitrary File upload (CVSS 8.0)
- [CVE-2021-23277](https://cve.now/CVE-2021-23277.md): Improper Neutralization of Directives in Dynamically Evaluated Code (CVSS 8.3)
- [CVE-2021-23281](https://cve.now/CVE-2021-23281.md): Remote Code execution (CVSS 10.0)
- [CVE-2021-23279](https://cve.now/CVE-2021-23279.md): Arbitrary File delete (CVSS 8.0)
- [CVE-2021-23276](https://cve.now/CVE-2021-23276.md): Improper Neutralization of Special Elements used in an SQL Command (CVSS 7.1)
- [CVE-2021-23278](https://cve.now/CVE-2021-23278.md): Arbitrary File delete (CVSS 8.7)
- [CVE-2020-6656](https://cve.now/CVE-2020-6656.md): File parsing Type Confusion Remote code execution vulerability (CVSS 5.8)
- [CVE-2020-6655](https://cve.now/CVE-2020-6655.md): File parsing Out-Of-Bounds read remote code execution (CVSS 5.8)
- [CVE-2020-6654](https://cve.now/CVE-2020-6654.md): DLL Hijacking (CVSS 7.8)
- [CVE-2020-6653](https://cve.now/CVE-2020-6653.md): Sensitive date stored in logcat file (CVSS 3.8)
- [CVE-2020-6651](https://cve.now/CVE-2020-6651.md): Command injection via specially crafted file name during config file upload (CVSS 8.8)
- [CVE-2020-6652](https://cve.now/CVE-2020-6652.md): Incorrect privilege assignment allowing non-admin users to upload config files (CVSS 7.8)
- [CVE-2020-6650](https://cve.now/CVE-2020-6650.md): Arbitrary code execution through “Update Manager” Class (CVSS 8.3)
- [CVE-2019-5625](https://cve.now/CVE-2019-5625.md): Eaton Halo Home Android App Insecure Storage (CVSS 2.8)
- [CVE-2018-7511](https://cve.now/CVE-2018-7511.md): In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/eaton
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.