These security flaws, if exploited, could allow attackers to execute arbitrary code on the host system, potentially giving them complete control over affected devices.
The advisory, identified as ETN-VA-2025-1026, highlights two specific vulnerabilities affecting all versions of the Eaton UPS Companion software before version 3.0.
The company has classified the overall risk as High, urging users to update their software immediately.
| CVE ID | Severity | Flaw Type | Issue Summary |
|---|---|---|---|
| CVE-2025-59887 | High (8.6) | Insecure Library Loading | A flaw in the installer allows attackers to run malicious code by exploiting insecure library loading. |
| CVE-2025-59888 | Medium (6.7) | Unquoted Search Path | An unquoted search path issue lets local attackers execute malicious files on the system. |
The most severe issue, tracked as CVE-2025-59887, carries a CVSS score of 8.6 (High). This vulnerability involves insecure library loading within the software installer.
Security researchers found that an attacker with access to the software package could exploit this flaw to execute arbitrary code.
This type of vulnerability often occurs when an application loads dynamic link libraries (DLLs) from an insecure path, allowing malicious files to be loaded instead of legitimate ones.
The second vulnerability, CVE-2025-59888 (CVSS 6.7), relates to an “improper quotation” issue in the software’s search paths.
In this scenario, if an attacker has access to the local file system, they could place a malicious executable in a specific location that the software unintentionally runs.
This flaw specifically targets how the Windows operating system handles file paths that contain spaces but lack quotation marks.
Eaton has released version 3.0 of the UPS Companion software to patch these flaws. The company strongly advises all customers to migrate to this secure version immediately.
The update is available for download through Eaton’s official software distribution channels. For users unable to apply the patch immediately, Eaton recommends the following mitigation steps: Restrict local and remote access to the host system to authorized personnel only.
Ensure that all control system networks are placed behind securely configured firewalls. Avoid downloading software from unofficial sources to prevent tampering.
By keeping systems up to date and restricting access, organizations can significantly reduce the risk of exploitation.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Eaton Vulnerabilities Let Attackers Execute Arbitrary Code On the Host System appeared first on Cyber Security News.
Today's links Corrupt anticorruption: Notes from a target-rich environment. Hey look at this: Delights to…
Robotics How Pokémon Go Is Giving Delivery Robots an Inch-Perfect View of the WorldWill Douglas…
Digital communication is well beyond picture and prose. Nowadays viewers demand more interactive and human-like…
AI video generators are revolutionizing the film industry in 2026 by drastically reducing VFX budgets,…
The AI cowork platform category has exploded in 2026. Where teams once relied on cloud-based…
AI is reshaping how companies run revenue operations. Sales teams are experimenting with AI-assisted outreach,…
This website uses cookies.