CVE-2026-22613 MEDIUM

CVE-2026-22613

Vendor Eaton

Product Network M3

Weakness CWE-295

Published February 9, 2026

Last update February 9, 2026

View on NVD All CVEs

CVSS base score

5.7/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton Network M3 which is available on the Eaton download center.

Key dates

02Disclosure timeline

February 9, 2026 CVE published

February 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-22613 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/295.html

Related vulnerabilities

04Related CVE

CVE-2025-33099 IBM Concert Software information disclosure CVE-2022-20814 Cisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation Vulnerability CVE-2024-31872 IBM Security Verify Access Appliance missing certificate validation CVE-2024-52329 ECOVACS HOME mobile app plugins do not properly validate TLS certificates CVE-2026-4740 Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation