CVE-2025-59886

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

Improper input validation at one of the endpoints of Eaton xComfort ECI's

web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Dec 23, 2025
Last modified
Oct 19, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-598878.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attackerCVE-2025-598886.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with CVE-2025-598898.6Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the CVE-2025-598907.3Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead intCVE-2025-598918.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticatCVE-2025-598928.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticatCVE-2025-598938.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticatCVE-2025-598948.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticatCVE-2025-598957.5Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the confCVE-2025-598965.4Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnCVE-2025-598975.4Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnCVE-2025-598985.4Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vuln
CVE-2025-59886: High severity, CVSS 8.8 | Vulnix