CVE-2026-22613

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton

Network M3

which is available on the Eaton download center.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Feb 9, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-226146.1The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access CVE-2026-226157.2Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privil CVE-2026-226167.5Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffi CVE-2026-226177.4Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the c CVE-2026-226187.1A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecur CVE-2026-226199.9Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut CVE-2026-22627.5The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via CVE-2026-226208.6Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote a CVE-2026-226218.3Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated CVE-2026-226228.8Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated CVE-2026-226237.2Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary c CVE-2026-226244.3Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without pro