{"id":"CVE-2026-22613","aliases":["EUVD-2026-6906","GHSA-fp59-gwjf-4gq6"],"status":"published","title":"The server identity check mechanism for firmware upgrade performed via command shell is...","description":"The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton \n\nNetwork M3\n\n which is available on the Eaton download center.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00188,"percentile":0.08535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2026-02-09T05:39:22Z","modified":"2026-06-17T10:20:09Z","products":[{"vendor":"eaton","product":"network m3"}],"references":[{"url":"https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1002.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22613"},{"url":"https://github.com/advisories/GHSA-fp59-gwjf-4gq6"}],"sources":{"cve":[{"id":"CVE-2026-22613","description":"The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton \n\nNetwork M3\n\n which is available on the Eaton download center.","status":"published","published":"2026-02-09T05:39:22.834Z","modified":"2026-02-09T16:10:46.212Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-6906","description":"The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton \n\nNetwork M3\n\n which is available on the Eaton download center.","status":"published","published":"2026-02-09T05:39:22Z","modified":"2026-02-09T16:10:46Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:42.465921Z"}],"ghsa":[{"id":"GHSA-fp59-gwjf-4gq6","title":"The server identity check mechanism for firmware upgrade performed via command shell is...","description":"The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton \n\nNetwork M3\n\n which is available on the Eaton download center.","status":"published","published":"2026-02-09T06:30:28Z","modified":"2026-02-09T06:30:37Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:06:05.991559Z"}],"nvd":[{"id":"CVE-2026-22613","description":"The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton \n\nNetwork M3\n\n which is available on the Eaton download center.","status":"published","published":"2026-02-09T06:16:24.36Z","modified":"2026-06-17T10:20:09.933Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:05.52517Z"}]}}