CVE-2025-59888
Improper Quotation in Eaton UPS Installer Enables Code Execution
Publication date: 2025-12-26
Last updated on: 2026-02-18
Assigner: Eaton
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eaton | ups_companion | to 3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to arbitrary code execution by an attacker with file system access, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Eaton UPS Companion software to the latest version available on the Eaton download center where the issue has been fixed.
Can you explain this vulnerability to me?
This vulnerability is caused by improper quotation in search paths within the Eaton UPS Companion software installer. This flaw could allow an attacker who has access to the file system to execute arbitrary code on the affected system.