PT-2025-52737 · Eaton · Eaton Xcomfort Eci

Published 2025-12-23 · Updated 2026-02-12 · CVE-2025-59886

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton xComfort ECI (affected versions not specified)

Description A flaw exists in the input validation process of a web interface endpoint within Eaton xComfort ECI. This could allow an attacker with network access to the device to execute commands with elevated privileges. The product has been discontinued, and no further security updates will be provided.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-59886

Affected Products

Eaton Xcomfort Eci

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-59886 · Security Note
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1022.pdf · Vendor Advisory
• https://t.me/CVEtracker/40476 · Telegram Post
• https://twitter.com/cracbot/status/2005232311256969699 · Twitter Post
• https://twitter.com/RaxisOne/status/2022078013949558969 · Twitter Post