Eaton Vulnerabilities Let Attackers Execute Arbitrary Code On the Host System

A critical security advisory addressing multiple vulnerabilities discovered in the Eaton UPS Companion (EUC) software.

These security flaws, if exploited, could allow attackers to execute arbitrary code on the host system, potentially giving them complete control over affected devices.

The advisory, identified as ETN-VA-2025-1026, highlights two specific vulnerabilities affecting all versions of the Eaton UPS Companion software before version 3.0.

The company has classified the overall risk as High, urging users to update their software immediately.

CVE ID	Severity	Flaw Type	Issue Summary
CVE-2025-59887	High (8.6)	Insecure Library Loading	A flaw in the installer allows attackers to run malicious code by exploiting insecure library loading.
CVE-2025-59888	Medium (6.7)	Unquoted Search Path	An unquoted search path issue lets local attackers execute malicious files on the system.

Vulnerability Details

The most severe issue, tracked as CVE-2025-59887, carries a CVSS score of 8.6 (High). This vulnerability involves insecure library loading within the software installer.

Security researchers found that an attacker with access to the software package could exploit this flaw to execute arbitrary code.

This type of vulnerability often occurs when an application loads dynamic link libraries (DLLs) from an insecure path, allowing malicious files to be loaded instead of legitimate ones.

The second vulnerability, CVE-2025-59888 (CVSS 6.7), relates to an “improper quotation” issue in the software’s search paths.

In this scenario, if an attacker has access to the local file system, they could place a malicious executable in a specific location that the software unintentionally runs.

This flaw specifically targets how the Windows operating system handles file paths that contain spaces but lack quotation marks.

Eaton has released version 3.0 of the UPS Companion software to patch these flaws. The company strongly advises all customers to migrate to this secure version immediately.

The update is available for download through Eaton’s official software distribution channels. For users unable to apply the patch immediately, Eaton recommends the following mitigation steps: Restrict local and remote access to the host system to authorized personnel only.

Ensure that all control system networks are placed behind securely configured firewalls. Avoid downloading software from unofficial sources to prevent tampering.

By keeping systems up to date and restricting access, organizations can significantly reduce the risk of exploitation.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.