Ipp Software EUVD-2026-23176

High-privilege user (administrator or operator) must actively interact with IPP while connected over a network where the attacker has presence (shared network, compromised WiFi, ARP spoofing capability, or ISP-level access). The vulnerability is exploitable only over unencrypted HTTP or when HTTPS is downgraded via network attack; default HTTPS deployments with proper Secure flag and HttpOnly attributes are not vulnerable. Attack complexity is rated High (AC:H) because the attacker must position themselves on the network path (not trivial in all environments) and time their interception with user activity. Non-default secure configurations (such as VPN access or segregated administrative networks) significantly reduce exploitability. The requirement for high privileges (PR:H) means only administrative accounts are at risk, not standard users.

This vulnerability presents moderate real-world risk with significant limiting factors. CVSS 5.7 is driven down by AC:H (attack complexity high), PR:H (high privilege required to trigger exploitation), and UI:R (user interaction required). These constraints mean the attacker must: (1) position themselves on the network path between a high-privilege user and the IPP server, (2) trick or intercept the high-privilege user's session, and (3) wait for the user to interact with the application. The information disclosure and integrity impact (C:H, I:H) are serious - compromised session cookies allow full impersonation of administrative accounts. EPSS data is unavailable, preventing assessment of weaponization probability. KEV status is unknown, so active exploitation cannot be confirmed. In typical enterprise deployments, IPP is accessed over VPN or segregated networks, reducing network exposure; however, organizations using IPP over untrusted or public networks face elevated risk. The high-privilege requirement (PR:H) suggests only administrators or operators are at risk, limiting the attack surface compared to vulnerabilities affecting unprivileged users.

An attacker on the same network as an IPP administrator (e.g., compromised WiFi, ARP spoofing on a LAN, or ISP-level interception) passively captures HTTPS traffic from the administrator's IPP session. Due to the insecure cookie configuration, the session cookie is transmitted in cleartext or without the Secure flag. The attacker extracts the high-privilege session cookie and replays it to the IPP server, gaining administrative access to power management controls without authentication. The attacker can then modify power settings, disable protections, or extract sensitive configuration data.