Ipp Software CVE-2026-22615

Exploitation requires four specific, non-default conditions: (1) attacker must possess valid administrator credentials for Eaton IPP (PR:H), (2) attacker must have network or local access to systems hosting IPP endpoints, (3) the XML input processing feature must be enabled (typical in default configurations but operationally dependent), and (4) a legitimate administrator must interact with the malicious XML-containing object (UI:R) by opening, importing, or processing the XML through the IPP interface. The vulnerability does NOT affect unauthenticated users or non-administrator accounts. Exploitation is limited to scenarios where administrator accounts are compromised or insider threats are credible.

The CVSS score of 6.0 presents a moderate-to-low risk profile that masks real-world severity through its constraint factors. The CVSS vector shows network accessibility (AV:N) countered by three significant barriers: elevated privileges (PR:H), high complexity (AC:H), and required user interaction (UI:R). This combination means exploitation is not trivial - the attacker must already possess administrator credentials, navigate complex attack conditions, and trigger user interaction. No EPSS score, KEV listing, or public exploit code is documented in the provided intelligence, indicating this is not currently a widespread or publicly exploited vulnerability. The CVSS integrity impact (I:H) and availability impact (A:H) are significant for environments using IPP for critical power distribution management, but the privilege and complexity barriers substantially reduce real-world exploitation probability. Organizations should assess this as a medium priority for patching, escalated only if they operate IPP in security contexts where insider threats or compromised administrator accounts are credible risk models. The local system access requirement in the description (despite the network vector) warrants clarification with Eaton - confirm whether the XML input must be delivered via local file or if network-accessible endpoints accept XML without re-authentication.

An attacker with compromised administrator credentials or insider status accesses the Eaton IPP web or local interface and uploads or injects malicious XML into a configuration file or import function. The XML contains improperly validated entity content designed to execute system commands with IPP process privileges. If the administrator then opens or processes the injected XML (user interaction requirement), arbitrary commands execute on the IPP host system.