{"identifier":"CVE-2026-22615","cve":{"id":"CVE-2026-22615","description":"Due to improper\ninput validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is\npossible for an attacker with admin privileges and access to the local system to\ninject malicious code resulting in arbitrary command execution. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.","published":"2026-04-16T05:16:14.433000+00:00","modified":"2026-10-26T22:10:00.163000+00:00","status":"Analyzed","score":6.0,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:eaton:intelligent_power_protector:*:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.00"}],"weaknesses":["CWE-20"],"references":[{"url":"https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf","source":"CybersecurityCOE@eaton.com","tags":["Vendor Advisory"]}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"CybersecurityCOE@eaton.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-16T12:59:53.063682Z","id":"CVE-2026-22615","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:eaton:intelligent_power_protector:*:*:*:*:*:*:*:*","versionEndExcluding":"2.00","matchCriteriaId":"A49C293B-6544-427F-AE61-CF7D5FEC50D0"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T10:19:11.167194+00:00","exploited":false,"kev_stale":false,"products":["eaton / intelligent power protector"],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00342,"percentile":0.27654,"date":"2026-10-29","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"www.eaton.com","source_url":"https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf","investigate_url":"https://investigate.aeglixmind.com/#www.eaton.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-22615","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-22615","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-22615","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}