CVE-2026-22617
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network-based attacker to intercept the cookie and exploit it through a man-in-the-middle attack.
Risk Assessment
An attacker can hijack a user session and gain access to protected resources or perform actions on the victim's behalf.
Recommendation
Update Eaton IPP to the latest version available on the Eaton download center. Ensure transmission encryption (HTTPS) and consider additional session protection mechanisms.
Other vulnerabilities in Eaton Intelligent Power Protector
See all- CVE-2026-22618Medium
A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web-based attacks. The issue has been fixed in the latest version of Eaton IPP available on the Eaton download centre.
- CVE-2026-22616Medium
Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate-limiting controls. This issue has been fixed in the latest version of Eaton IPP available on the Eaton download centre.
- CVE-2026-22615Medium
Eaton Intelligent Power Protector (IPP) contains improper input validation in one of its XML files. An attacker with admin privileges and local system access could inject malicious code resulting in arbitrary command execution.
Original NVD description (English source)
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS