CVE-2025-59886: Input Validation
Improper input validation at one of the endpoints of Eaton xComfort ECI's
web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59886?
CVE-2025-59886 is deemed to have a high severity due to its potential for allowing unauthorized execution of privileged user commands.
How can I fix CVE-2025-59886?
To fix CVE-2025-59886, users should apply the latest patches from Eaton for the xComfort ECI web interface.
What type of vulnerability is CVE-2025-59886?
CVE-2025-59886 is classified as an improper input validation vulnerability affecting the Eaton xComfort ECI web interface.
Who is affected by CVE-2025-59886?
Users of Eaton xComfort ECI devices with network access to the web interface are affected by CVE-2025-59886.
Can CVE-2025-59886 be exploited remotely?
Yes, CVE-2025-59886 can be exploited remotely by an attacker with network access to the vulnerable Eaton xComfort ECI device.