CVE-2026-22617

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22617", "assignerOrgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "state": "PUBLISHED", "assignerShortName": "Eaton", "dateReserved": "2026-01-08T04:55:11.729Z", "datePublished": "2026-04-16T05:02:07.710Z", "dateUpdated": "2026-04-16T13:23:29.510Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "shortName": "Eaton", "dateUpdated": "2026-04-16T05:02:07.710Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-614", "description": "CWE-614 Sensitive cookie in HTTPS session without 'secure' attribute", "type": "CWE"}]}], "affected": [{"vendor": "Eaton", "product": "IPP Software", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network\u2011based attacker to intercept the cookie and exploit it through a man\u2011in\u2011the\u2011middle attack.\u00a0This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network\u2011based attacker to intercept the cookie and exploit it through a man\u2011in\u2011the\u2011middle attack.&nbsp;<span>This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.</span></div>"}]}], "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:20:03.215264Z", "id": "CVE-2026-22617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:23:29.510Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T13:20:03.215264Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:23:20.084Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eaton", "product": "IPP Software", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network\u2011based attacker to intercept the cookie and exploit it through a man\u2011in\u2011the\u2011middle attack.\u00a0This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.", "supportingMedia": [{"type": "text/html", "value": "<div>Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network\u2011based attacker to intercept the cookie and exploit it through a man\u2011in\u2011the\u2011middle attack.&nbsp;<span>This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-614", "description": "CWE-614 Sensitive cookie in HTTPS session without 'secure' attribute"}]}], "providerMetadata": {"orgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "shortName": "Eaton", "dateUpdated": "2026-04-16T05:02:07.710Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22617", "state": "PUBLISHED", "dateUpdated": "2026-04-16T13:23:29.510Z", "dateReserved": "2026-01-08T04:55:11.729Z", "assignerOrgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "datePublished": "2026-04-16T05:02:07.710Z", "assignerShortName": "Eaton"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "IPP Software", "vendor": "Eaton", "versions": [{"lessThan": "2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "CybersecurityCOE@eaton.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eaton:intelligent_power_protector:*:*:*:*:*:*:*:*", "matchCriteriaId": "A49C293B-6544-427F-AE61-CF7D5FEC50D0", "versionEndExcluding": "2.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network\u2011based attacker to intercept the cookie and exploit it through a man\u2011in\u2011the\u2011middle attack.\u00a0This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre."}, {"lang": "es", "value": "Eaton Intelligent Power Protector (IPP) utiliza una configuraci\u00f3n de cookie insegura, lo que podr\u00eda permitir a un atacante basado en la red interceptar la cookie y explotarla mediante un ataque de intermediario (man-in-the-middle). Este problema de seguridad ha sido solucionado en la \u00faltima versi\u00f3n del software Eaton IPP, que est\u00e1 disponible en el centro de descargas de Eaton."}], "id": "CVE-2026-22617", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.2, "source": "CybersecurityCOE@eaton.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22617", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:20:03.215264Z", "version": "2.0.3"}}]}, "published": "2026-04-16T06:16:08.980", "references": [{"source": "CybersecurityCOE@eaton.com", "tags": ["Vendor Advisory"], "url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "sourceIdentifier": "CybersecurityCOE@eaton.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-614"}], "source": "CybersecurityCOE@eaton.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "IPP Software", "source": "cna", "vendor": "Eaton"}, "product": "ipp_software", "vendor": "eaton"}], "analysis": {"en": {"generated_at": "2026-04-17T04:54:42.731050+00:00", "value": {"mitigation_remediation": ["Apply the latest Eaton IPP software update that resolves the insecure cookie configuration. ", "Configure the device to use HTTPS exclusively for management and monitoring traffic, ensuring cookies are transmitted over an encrypted channel. ", "Review access control and network segmentation to limit exposure of the IPP management interface to trusted hosts only."], "summary": {"action": "Patch ASAP", "impact": "Insecure cookie configuration permits man\u2011in\u2011the\u2011middle interception of credentials or privileged data."}, "threat_synthesis": {"affected_systems": "The vulnerability affects Eaton Intelligent Power Protector (IPP) devices. The product details mention a publicly released patch that addresses the insecure cookie handling. No specific firmware or software versions are listed in the data, so all IPP installations are potentially susceptible until they apply the latest update.", "description_and_impact": "Eaton Intelligent Power Protector software stores authentication information in cookies that lack secure attributes, making the cookie visible to traffic snoops. An attacker who can observe network traffic could intercept the cookie and use it to impersonate a legitimate user or execute operations on the device. This vulnerability directly jeopardizes confidentiality and authenticity of the device\u2019s session data.", "risk_and_exploitability": "The CVSS score of 5.7 indicates a moderate severity. There is no EPSS score provided, and the issue is not in the CISA KEV catalog, suggesting that documented exploitation is unknown at this time. Nevertheless, because the flaw relies on traffic interception, any network path that the attacker can access could be sufficient to replay the cookie, especially if HTTPS is not enforced. The attack vector is inferred to be network-based MITM. Organizations using IPP should assume the risk until the fix is applied."}}}}, "created": "2026-04-16T07:00:10.745385+00:00", "title": "Insecure Cookie Configuration in Eaton IPP Allows Network-Based Man-in-the-Middle Interception", "updated": "2026-04-17T05:00:05.510790+00:00", "vendors": ["eaton", "eaton$PRODUCT$ipp_software"]}