Eaton xComfort ECI CVE-2025-59886

Requires network access to the xComfort ECI web management interface AND a valid low-privilege authenticated session (CVSS PR:L), after which malformed input to a specific (undisclosed) web endpoint yields execution of privileged user commands. Limiting factors: the attacker must be able to reach the management web interface (so exploitation is prevented by segmenting the device onto an isolated OT/management network and blocking untrusted access), and must already possess low-level credentials - this is not an unauthenticated flaw. Because the product is discontinued with no forthcoming patches, network isolation and credential hardening are the only available controls.

This is a credible mid-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) to achieve full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with an authenticated user escalating to execute privileged commands via an input-validation weakness (CWE-20). However, the real-world exploitation signals are modest and consistent with each other: EPSS is only 0.32% (24th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code was identified. There is no SSVC decision data provided. The signals therefore do not conflict - a high technical severity (8.8) coexists with low observed/predicted exploitation, which is typical for a niche industrial/building-automation product. The most important real-world modifier is that Eaton has discontinued the product and will issue no further security updates, so this flaw is permanently unpatched; risk must be managed through network isolation rather than remediation. Note the input Tag 'Information Disclosure' understates the impact: the description and CVSS (I:H/A:H) indicate privileged command execution, not mere disclosure.

An attacker who can reach the xComfort ECI web interface and holds (or obtains) low-privilege credentials sends malformed input to the affected endpoint, which fails to validate it properly, allowing the attacker to execute commands reserved for a privileged user. No public exploit code was identified at time of analysis, so this requires custom tooling, and exploitation depends on the web management interface being network-reachable to the attacker.