{"id":"CVE-2022-33859","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-33859","generatedAt":"2026-10-27T17:30:16.422Z","title":"A security vulnerability was discovered in the Eaton Foreseer EPMS software.","description":"A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary files using the file upload feature. \n\nThis vulnerability is present in versions 4.x, 5.x, 6.x & 7.0 to 7.5. A new version (v7.6) containing the remediation has been made available by Eaton and a mitigation has been provided for the affected versions that are currently supported. \n\nCustomers are advised to update the software to the latest version (v7.6).\n\nForeseer EPMS versions 4.x, 5.x, 6.x are no longer supported by Eaton. Please refer to the  End-of-Support notification https://www.eaton.com/in/en-us/catalog/services/foreseer/foreseer-legacy.html .","published":"2022-10-28T02:15:17.000Z","lastModified":"2026-06-17T04:49:23.000Z","status":"Modified","sourceIdentifier":"CybersecurityCOE@eaton.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-434"],"affected":["eaton/foreseer electrical power monitoring system"],"epss":{"score":0.00412,"percentile":0.35203,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.eaton.com/us/en-us/company/news-insights/cybersecurity/security-notifications.html","tags":["Vendor Advisory"],"source":"CybersecurityCOE@eaton.com"},{"url":"https://www.eaton.com/us/en-us/company/news-insights/cybersecurity/security-notifications.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-33859","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}