Ipp Software CVE-2026-22616

The IPP web interface must be directly accessible from the attacker's network (default: network-reachable, no authentication required for the login page itself). No special configuration or feature enablement is explicitly stated in the description; the vulnerability exists in the default login mechanism. The attack succeeds only if the IPP instance is running a vulnerable version (any version prior to the patched release). No user interaction or advanced privileges are required-an anonymous network attacker can initiate brute-force attacks immediately. Exploitation is limited only by network availability (uptime of the IPP service) and the entropy of credentials being tested (stronger or unique passwords increase the required attempt count).

CVSS 6.5 (AV:N/AC:L/PR:N/UI:N) reflects a realistic threat: network-accessible login without authentication required or user interaction. The vulnerability is not a memory corruption or code execution flaw but rather a logical control deficiency, making it reliably exploitable by standard tools (credential enumeration, dictionary attacks, brute-force). The lack of KEV status or confirmed active exploitation does not diminish risk-brute-force attacks against power management software are high-value targeting scenarios (critical infrastructure), and the absence of public POC or KEV listing may simply reflect attribution lag or targeted exploitation by threat actors without disclosure. The C:L/I:L impact (partial confidentiality and integrity loss through credential compromise) aligns with the ability to gain administrative or user account access to power infrastructure monitoring. Exploitation complexity is low (standard HTTP requests, no special protocol or configuration required), making this a priority for defenders managing internet-facing IPP instances.

An attacker discovers an Eaton IPP instance on the internet via port scanning or asset enumeration. Using a credential dictionary or wordlist targeting common default accounts (admin, support, operator), the attacker submits hundreds of login requests per minute against the login endpoint without encountering rate-limiting, delays, or lockouts. Upon successful credential discovery, the attacker gains authenticated access to the power management console, enabling reconnaissance of connected UPS systems, configuration changes, or denial-of-service against critical power infrastructure.