CVE-2018-16158: Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across...

Security readout for executives and security teams

Some Eaton Power Xpert Meter 4000, 6000, and 8000 devices shipped with the same SSH private key across different customer installations. If a vulnerable device exposes SSH, an attacker with the key could authenticate as root. This is serious for environments using these meters in operational networks. Exposure is most likely where affected Eaton PXM devices run firmware before 13.4.0.10 and SSH is reachable from untrusted, flat, or poorly segmented networks. Treat this as high priority for facilities, energy, and industrial environments because successful abuse could give root access to power metering equipment. Prioritize internet-exposed or broadly reachable devices first. Mitigation focus: Inventory Eaton PXM 4000, 6000, and 8000 meters and firmware versions.; Upgrade affected devices according to Eaton guidance, targeting 13.4.0.10 or later where applicable.; Restrict SSH management access to trusted administrative networks only..

Prepared

Jun 7, 2026, 05:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.