CVE-2025-59886_CVE-2025-59886

8.8 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Improper input validation at one of the endpoints of Eaton xComfort ECI's

web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity
standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the
product. Upon retirement or end of support, there will be no new security updates, non-security
updates, or paid assisted support options, or online technical content updates.

AI Analysis

Improper input validation vulnerability allowing execution of privileged user commands

Basic Information

ID CVE-2025-59886

Source Eaton

Published Dec 23, 2025 at 11:31

Affected Product

Vendor Eaton

Product Eaton xComfort ECI

Affected Versions Eaton Eaton xComfort ECI 0

CWE Classification

CWE-20

AI Assessment

AI Score 8.8 / 10

AI Severity High

Vendor Eaton

Product xComfort ECI

References

www.eaton.com /content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1022.pdf

{
    "lastseen": "",
    "description": "Improper input validation at one of the endpoints of Eaton xComfort ECI's \n\nweb interface, could lead into an attacker with network access to the device executing privileged user commands.\u00a0As cybersecurity\nstandards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the\nproduct. Upon retirement or end of support, there will be no new security updates, non-security\nupdates, or paid assisted support options, or online technical content updates.",
    "published": "2025-12-23T11:31:31.339Z",
    "modified": "2025-12-23T11:31:31.339Z",
    "type": "cve",
    "title": "CVE-2025-59886",
    "source": "Eaton",
    "references": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1022.pdf",
    "id": "CVE-2025-59886",
    "bulletinFamily": "",
    "cwe": [
        "CWE-20"
    ],
    "cvelist": null,
    "sourceData": "Eaton Eaton xComfort ECI 0",
    "sourceHref": "",
    "cvss": {
        "score": 8.8,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Eaton xComfort ECI",
    "version": "0",
    "vendor": "Eaton",
    "ai_description": "Improper input validation vulnerability allowing execution of privileged user commands",
    "ai_severity": "High",
    "ai_vendor": "Eaton",
    "ai_product": "xComfort ECI",
    "ai_version": "0",
    "ai_score": 8.8
}