What is the CVSS score of EUVD-2026-23176?

EUVD-2026-23176 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-23176?

Yes, a patch is available for EUVD-2026-23176. Update the affected software to the latest version immediately.

Ipp Software EUVD-2026-23176

| CVE-2026-22617 MEDIUM

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614)

2026-04-16 Eaton

GHSA-m6jh-hgc7-xggx

Information Disclosure Ipp Software

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 22, 2026 - 20:01 nvd

Patch available

Apr 16, 2026 - 06:01 EUVD

Analysis Generated

Apr 16, 2026 - 05:59 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23176

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:02 nvd

MEDIUM 5.7

DescriptionCVE.org

Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.

AnalysisAI

Eaton Intelligent Power Protector (IPP) software uses insecure cookie configuration that allows network attackers to intercept session cookies via man-in-the-middle attack when high-privilege users interact with the application. CVSS 5.7 reflects the requirement for high privileges and user interaction, combined with high confidentiality and integrity impact. Eaton has released a patched version available on their download center.

Technical ContextAI

The vulnerability stems from CWE-614 (Insecure Cookie in HTTPS Session Without Secure Attribute), a common web application security flaw where session cookies lack the Secure flag and/or HttpOnly flag attributes. When cookies are transmitted without the Secure flag, they are sent over unencrypted HTTP connections in addition to HTTPS, making them susceptible to network-level interception. The IPP software, used for power management and monitoring in enterprise environments, appears to handle sensitive session state via cookies. Attackers positioned on the network path (LAN, ISP, compromised WiFi, ARP spoofing, DNS hijacking) can capture these cookies and reuse them to impersonate authenticated users, bypassing session security controls entirely.

RemediationAI

Primary remediation is to upgrade to the latest patched version of Eaton IPP software available from the Eaton download center (https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf). Exact version numbers are not specified in available advisories - confirm the latest version with Eaton support or the download portal before deployment. Interim compensating controls include: (1) Enforce HTTPS-only access to IPP by disabling HTTP entirely and configuring HSTS headers to prevent protocol downgrade; (2) Restrict IPP access to trusted networks via firewall rules, allowing only specific administrative subnets or VPN-authenticated sources; (3) Deploy network-level monitoring to detect suspicious cookie reuse or session anomalies; (4) Require VPN or proxy authentication as an additional layer before reaching IPP; (5) Implement regular session timeout policies to limit the window for cookie exploitation. Trade-off: restricting network access may impact legitimate remote administration workflows unless properly designed.