An insecure server identity check is used when the device performs a firmware upgrade via the command shell. The check does not properly validate the server’s certificate, which can allow a malicious actor to place themselves between the device and the upgrade host, intercepting the firmware download. Based on the description, it is inferred that the attacker could potentially substitute a tampered image. This flaw enables a Man‑in‑the‑Middle attack during firmware transfer.

The vulnerability affects Eaton Network M3 devices that rely on the command‑shell interface for firmware updates. All firmware releases before the fix are susceptible; the latest firmware version issued by Eaton includes the corrective changes and is available on the Eaton download center.

The CVSS score of 5.7 indicates moderate overall risk. An EPSS score of under 1 % suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to interfere with the firmware update path or exploit the command shell to hijack the upgrade traffic. Once the attack is successful, based on the description, it is inferred that the attacker could supply a malicious firmware image, potentially compromising device operation. If the device is exposed to attackers who can reach the management interface or the network path used for upgrades, the risk remains significant.