Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

Eaton-Intelligent-Power-Manager-Local-File-Inclusion

Eaton-Intelligent-Power-Manager-Local-File-Inclusion Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file, it can lead to sensitive information disclosure, denial of service and code execution. CVE-2018-12031 To exploit vulnerability, someone could use...

Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

CVE-2026-41021

Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials...

CVE-2026-41022

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4...

CVE-2026-41020

Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device...

CVE-2026-41022

Eaton easySoft software is vulnerable due to improper validation of TLS certificates presented by easyE4 devices. A network-adjacent attacker can exploit this flaw to conduct a man-in-the-middle (MITM) attack , allowing them to intercept or modify communications between easySoft and the easyE4 de...

EUVD-2026-110757

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4...

CVE-2026-41022

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4...

EUVD-2026-110813

Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials...

CVE-2026-41021

The Eaton easyE4 is impacted by a vulnerability caused by an insufficiently strong password policy . If an attacker obtains a password hash (potentially through CVE-2026-41020), they can perform an offline password-guessing attack to recover user credentials. The documents do not provide specific...

CVE-2026-41021

Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials...

CVE-2026-41020

Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device...

EUVD-2026-110808

Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device...

CVE-2026-41020

The Eaton easyE4 device is vulnerable to an authentication bypass due to the use of a static nonce during the authentication process. An unauthenticated attacker who can capture authentication traffic may perform a replay attack using a valid exchange to gain unauthorized access to the device. Th...

PT-2026-126377

Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device...

PT-2026-126391

Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials...

Eaton easyE4 authorization issue vulnerability

Versions of Eaton easyE4 prior to 2.46 contain an authorization issue vulnerability. This vulnerability stems from the use of static random numbers during authentication, which may allow unauthenticated attackers to replay valid authentication exchanges by exploiting captured authentication...

Eaton easyE4 authorization issue vulnerability

Versions prior to 2.46 of the Eaton easyE4 contain an authorization issue vulnerability. This vulnerability stems from insufficient strength in password policies, potentially allowing attackers to obtain password hashes and carry out offline brute-force attacks to recover user credentials...

Eaton easysoft encryption issue vulnerability

Versions of Eaton EasySoft prior to 8.46 contain an encryption vulnerability. This vulnerability stems from improper validation of TLS certificates provided by the easyE4 device, potentially allowing network-neighboring attackers to perform man-in-the-middle attacks and intercept or modify...