PT-2022-21875 · Eaton · Eaton Foreseer Epms

Michael · Published 2022-10-28 · Updated 2023-10-18 · CVE-2022-33859

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton Foreseer EPMS versions 4.x through 7.5

Description A security issue was discovered in the Eaton Foreseer EPMS software, which connects devices to reduce energy consumption and prevent unplanned downtime. The problem allows a threat actor to upload arbitrary files using the file upload feature.

Recommendations For versions 7.0 through 7.5, update the software to the latest version (v7.6). For versions 4.x, 5.x, and 6.x, refer to the End-of-Support notification as these versions are no longer supported by Eaton. As a temporary workaround for currently supported versions, consider implementing the provided mitigation until the update to version 7.6 can be applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-33859

Affected Products

Eaton Foreseer Epms

References · 4

• https://eaton.com/us/en-us/company/news-insights/cybersecurity/security-notifications.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33859 · Security Note
• https://t.me/cibsecurity/52194 · Telegram Post