CVE-2025-59886
- State
- Published
- Severity
- 8.8 High
- Published
- Dec 23, 2025
- Updated
- Dec 23, 2025
- Reserved
- Sep 23, 2025
Description
Improper input validation at one of the endpoints of Eaton xComfort ECI's
web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Eaton |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
Eaton xComfort ECIEaton |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.