PT-2025-53452 · Eaton · Eaton Ups Companion

Published 2025-12-26 · Updated 2026-01-05 · CVE-2025-59887

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eaton UPS Companion software (affected versions not specified)

Description A flaw exists in the Eaton UPS Companion software installer related to improper authentication of library files. This could allow an attacker who has access to the software package to execute arbitrary code.

Recommendations Update to the latest version of the Eaton UPS Companion software available on the Eaton download center.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-59887

Affected Products

Eaton Ups Companion

References · 13

• https://osv.dev/vulnerability/CVE-2025-59887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59887 · Security Note
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1026.pdf · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/2007990349571170571 · Twitter Post
• https://t.me/CVEtracker/40702 · Telegram Post
• https://reddit.com/r/KryptonSecurity/comments/1q4o6hb/weekly_recap_cvss_100_en_react_supply_chain · Reddit Post
• https://twitter.com/ThreatSynop/status/2008087747718697311 · Twitter Post
• https://twitter.com/ThreatSynop/status/2008120343722934518 · Twitter Post
• https://t.me/cveNotify/146865 · Telegram Post
• https://twitter.com/CVEnew/status/2004457720259531128 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2004458572906664438 · Twitter Post
• https://twitter.com/cracbot/status/2006319470936268940 · Twitter Post
• https://twitter.com/CveFindCom/status/2004456938604482886 · Twitter Post