CVE-2026-22616

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22616", "assignerOrgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "state": "PUBLISHED", "assignerShortName": "Eaton", "dateReserved": "2026-01-08T04:55:11.728Z", "datePublished": "2026-04-16T04:54:48.148Z", "dateUpdated": "2026-04-16T13:30:12.024Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "shortName": "Eaton", "dateUpdated": "2026-04-16T04:54:48.148Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-307", "description": "CWE-307 Improper restriction of excessive authentication attempts", "type": "CWE"}]}], "affected": [{"vendor": "Eaton", "product": "IPP Software", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Eaton\u00a0Intelligent Power Protector (IPP)\u00a0software\u00a0allows repeated authentication attempts against the web interface login page due to insufficient rate\u2011limiting controls.\u00a0This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Eaton&nbsp;<span>Intelligent Power Protector (IPP)</span><span>&nbsp;software</span><span>&nbsp;</span><span>allows repeated authentication attempts against the web interface login page due to insufficient rate\u2011limiting controls.&nbsp;</span><span>This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.</span></p>"}]}], "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:23:56.166508Z", "id": "CVE-2026-22616", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:30:12.024Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T13:23:56.166508Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:30:06.472Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eaton", "product": "IPP Software", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Eaton\u00a0Intelligent Power Protector (IPP)\u00a0software\u00a0allows repeated authentication attempts against the web interface login page due to insufficient rate\u2011limiting controls.\u00a0This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.", "supportingMedia": [{"type": "text/html", "value": "<p>Eaton&nbsp;<span>Intelligent Power Protector (IPP)</span><span>&nbsp;software</span><span>&nbsp;</span><span>allows repeated authentication attempts against the web interface login page due to insufficient rate\u2011limiting controls.&nbsp;</span><span>This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper restriction of excessive authentication attempts"}]}], "providerMetadata": {"orgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "shortName": "Eaton", "dateUpdated": "2026-04-16T04:54:48.148Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22616", "state": "PUBLISHED", "dateUpdated": "2026-04-16T13:30:12.024Z", "dateReserved": "2026-01-08T04:55:11.728Z", "assignerOrgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "datePublished": "2026-04-16T04:54:48.148Z", "assignerShortName": "Eaton"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "IPP Software", "vendor": "Eaton", "versions": [{"lessThan": "2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "CybersecurityCOE@eaton.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eaton:intelligent_power_protector:*:*:*:*:*:*:*:*", "matchCriteriaId": "A49C293B-6544-427F-AE61-CF7D5FEC50D0", "versionEndExcluding": "2.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eaton\u00a0Intelligent Power Protector (IPP)\u00a0software\u00a0allows repeated authentication attempts against the web interface login page due to insufficient rate\u2011limiting controls.\u00a0This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre."}, {"lang": "es", "value": "El software Eaton Intelligent Power Protector (IPP) permite intentos repetidos de autenticaci\u00f3n contra la p\u00e1gina de inicio de sesi\u00f3n de la interfaz web debido a controles insuficientes de limitaci\u00f3n de velocidad. Este problema de seguridad ha sido solucionado en la \u00faltima versi\u00f3n de Eaton IPP, la cual est\u00e1 disponible en el centro de descargas de Eaton."}], "id": "CVE-2026-22616", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "CybersecurityCOE@eaton.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22616", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:23:56.166508Z", "version": "2.0.3"}}]}, "published": "2026-04-16T05:16:14.563", "references": [{"source": "CybersecurityCOE@eaton.com", "tags": ["Vendor Advisory"], "url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "sourceIdentifier": "CybersecurityCOE@eaton.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "CybersecurityCOE@eaton.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "IPP Software", "source": "cna", "vendor": "Eaton"}, "product": "ipp_software", "vendor": "eaton"}], "analysis": {"en": {"generated_at": "2026-04-16T08:57:55.135639+00:00", "value": {"mitigation_remediation": ["Apply the latest Eaton IPP software update that resolves the rate-limiting issue.", "Restrict network access to the IPP web interface to trusted IP ranges or implement firewall rules that limit exposure.", "Enforce strong passwords and, if supported, enable two-factor authentication for IPP user accounts."], "summary": {"action": "Apply patch", "impact": "Credential compromise risk"}, "threat_synthesis": {"affected_systems": "Eaton:IPP Software, specifically the Eaton Intelligent Power Protector product. All releases prior to the most recent update are affected; the issue was resolved in the latest version available from the Eaton download centre.", "description_and_impact": "Eaton Intelligent Power Protector (IPP) software permits repeated authentication attempts against its web interface login page because rate-limiting controls are inadequate. This flaw enables a brute-force approach that could allow an attacker to guess valid credentials and gain unauthorized access to the device\u2019s configuration and monitoring functions.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, but the EPSS metric is not available, so precise exploitation probability remains unknown. The vulnerability has not been reported in the CISA KEV catalog. The likely attack vector is the publicly accessible web interface, which, if exposed to the Internet or a wide internal network, gives an attacker significant opportunity to launch repeated login attempts. Due to the lack of rate limitation, a determined attacker could potentially discover valid credentials, leading to unauthorized control of the device."}}}}, "created": "2026-04-16T06:30:05.894200+00:00", "title": "Repeated Authentication Attempts Due to Insufficient Rate\u2011Limiting in Eaton IPP Web Interface", "updated": "2026-04-16T09:00:05.295207+00:00", "vendors": ["eaton", "eaton$PRODUCT$ipp_software"]}