CVE-2018-9279 is a cleartext password disclosure (CWE-522) in the web management interface of Eaton's 9PX 8000 SP uninterruptible power supply: the appliance's own web page embeds the logged-in user's password in plain text in its HTML source, so anyone who can view that page source (for example, over a shoulder-surfed or shared session, or via another low-privilege web flaw) can recover the credential; NVD has published its own Primary CVSS v3.0 score of 4.9 (medium) for this flaw.
Vulnerability summary
4.9
Medium
1.0%
EPSS score (FIRST)
No
CISA KEV catalog
2018-10-24
Published
Vulnerability ID: CVE-2018-9279 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Eaton 9PX UPS firmware (web management interface) | cpe:2.3:o:eaton:9px_ups_firmware:-:*:*:*:*:*:*:* | Eaton UPS 9PX 8000 SP, firmware as shipped prior to the October 2018 fix; patched firmware available from Eaton's connectivity firmware downloads page |
What does this mean for affected devices?
CVE-2018-9279 (CWE-522, insufficiently protected credentials) affects the web management interface of the Eaton 9PX 8000 SP uninterruptible power supply. NVD's description states: "An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage" (NVD).
The flaw was reported by Florian Nivette and Kelly Albrink of security research firm Bishop Fox, who disclosed it together with two related issues in the same 9PX 8000 SP web interface: CVE-2018-9280, a cleartext disclosure of the SNMPv3 read/write user's password, and CVE-2018-9281, a cross-site request forgery that let an attacker "force a logged-in administrator to perform a silent password update" by luring them to a malicious page. Bishop Fox's advisory states that Eaton "developed and released firmware fixes addressing all vulnerabilities," made available on Eaton's connectivity firmware downloads page, after a disclosure process that ran from the researchers' March 2018 report to the October 2018 public advisory (Bishop Fox).
NVD lists a Primary CVSS v3.0 score of 4.9 (medium), vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, sourced directly from [email protected]; the PR:H component reflects that an attacker needs high (administrator-level) privileges to already be logged in before the password disclosure can be exploited (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01043 (64.3rd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
Operators of Eaton 9PX 8000 SP units should confirm they are running firmware that post-dates Eaton's October 2018 fix, avoid leaving the UPS web management page open or exposed to shared or untrusted screens, and avoid exposing the management interface directly to the internet.
Evidence
- An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage. — NVD
- Reported by Florian Nivette and Kelly Albrink of Bishop Fox alongside two related flaws (SNMPv3 password disclosure CVE-2018-9280, CSRF silent password update CVE-2018-9281); Eaton released firmware fixes for all three after a March-to-October 2018 disclosure process. — Bishop Fox Security Advisory
- NVD Primary CVSS v3.0 score 4.9 (medium), vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, source [email protected]. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01043 (64.3rd percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
