Eaton UPS Software Flaws Expose Systems to High-Risk Code Execution

Eaton disclosed two high‑risk vulnerabilities in its UPS Companion software, tracked as CVE‑2025‑59887 and CVE‑2025‑59888, that could allow local attackers to hijack the software and execute arbitrary code on the host.

The most severe flaw, CVE‑2025‑59887, arises from insecure library loading in the Eaton IPP software installer, which could let an attacker place a malicious file in the installer directory and trigger code execution with the same privileges as the user running the installation, according to the advisory. The second flaw, CVE‑2025‑59888 (CVSS 6.7), is an Unquoted Search Path vulnerability where a Windows service path with spaces may be misinterpreted, potentially causing the system to run an unintended program.

The advisory, released on 24 December 2025, rates the overall risk as High with a maximum CVSS score of 8.6 and notes that all versions of Eaton UPS Companion prior to version 3.0 are affected. Eaton recommends upgrading to version 3.0 to resolve both issues. These vulnerabilities could allow an attacker with file-system access to perform arbitrary code execution on affected systems.