Last December Eaton issued an advisory for their xComfort Ethernet Communication Interface (CVE-2025-59886) for a remote code execution/command injection vulnerability. Proof of concept exploit code has recently been published on GitHub.
Eaton’s advisory was released on December 22nd, and the xComfort ECI product was discontinued and will no longer receive security updates after November 30th, 2025. If your organization uses these Eaton devices it is recommended to isolate them to prevent unauthorized access and to prioritize upgrading or replacing them with a supported alternative.
For those of you on internal and external security teams, keep an eye out for Eaton xComfort so that we can bring attention to these out-of-date devices with trivially easy to exploit vulnerabilities.
