Xcomfort Ethernet Communication Interface
Monthly
Improper input validation in the web management interface of Eaton xComfort ECI lets an attacker who already holds a low-privilege authenticated session send malformed requests to a specific endpoint and thereby execute privileged user commands on the device, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires network reachability to the ECI web interface plus valid low-level credentials - this is not an unauthenticated flaw - and EPSS is 0.32% (24th percentile) with no public exploit identified at time of analysis. Eaton has discontinued the product and will not ship security updates, so no vendor-released patch is expected.
An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper input validation in the web management interface of Eaton xComfort ECI lets an attacker who already holds a low-privilege authenticated session send malformed requests to a specific endpoint and thereby execute privileged user commands on the device, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires network reachability to the ECI web interface plus valid low-level credentials - this is not an unauthenticated flaw - and EPSS is 0.32% (24th percentile) with no public exploit identified at time of analysis. Eaton has discontinued the product and will not ship security updates, so no vendor-released patch is expected.
An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.