CVE-2022-33859

A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary files using the file upload feature. This vulnerability is present in versions 4.x, 5.x, 6.x & 7.0 to 7.5. A new version (v7.6) containing the remediation has been made available by Eaton and a mitigation has been provided for the affected versions that are currently supported. Customers are advised to update the software to the latest version (v7.6). Foreseer EPMS versions 4.x, 5.x, 6.x are no longer supported by Eaton. Please refer to the End-of-Support notification https://www.eaton.com/in/en-us/catalog/services/foreseer/foreseer-legacy.html .
Configurations

Configuration 1 (hide)

cpe:2.3:a:eaton:foreseer_electrical_power_monitoring_system:*:*:*:*:*:*:*:*

History

01 Nov 2022, 18:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References (MISC) https://www.eaton.com/us/en-us/company/news-insights/cybersecurity/security-notifications.html - (MISC) https://www.eaton.com/us/en-us/company/news-insights/cybersecurity/security-notifications.html - Vendor Advisory
CPE cpe:2.3:a:eaton:foreseer_electrical_power_monitoring_system:*:*:*:*:*:*:*:*
CWE CWE-434

28 Oct 2022, 02:33

Type Values Removed Values Added
New CVE

Information

Published : 2022-10-28 02:15

Updated : 2024-02-04 22:51


NVD link : CVE-2022-33859

Mitre link : CVE-2022-33859

CVE.ORG link : CVE-2022-33859


JSON object : View

Products Affected

eaton

  • foreseer_electrical_power_monitoring_system
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type