Insecure Firmware Upgrade Mechanism in Eaton Network M3
CVE-2026-22613

5.7MEDIUM

Key Information:

Vendor

Eaton

Status
Network M3
Vendor
CVE Published:
9 February 2026

What is CVE-2026-22613?

The Eaton Network M3 has an insecurely implemented server identity check mechanism for firmware upgrades via the command shell. This vulnerability could enable an attacker to intercept and manipulate firmware updates, potentially leading to unauthorized access and compromised system integrity. Eaton has addressed this issue in the latest firmware release, available for download to ensure users can secure their devices against such attacks.

Affected Version(s)

Network M3 0 < 2.3.3

References

https://www.eaton.com/content/dam/eaton/company/news-insi...

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.