CVE-2026-22613CWE-295

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a…

Medium · published February 9, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton

Network M3

which is available on the Eaton download center.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-02-09T05:39Z
EPSS history
Timeline
  • 09 FEB 05:39Z
    The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a…
    cvelistv5