Eaton IPP EUVD-2026-23178

Exploitation requires the attacker to have access to the Eaton IPP software package or its load path - specifically the ability to place or substitute a library (CWE-427 insecure library loading) that the IPP executable will load. This is a local prerequisite, not a default remote-unauthenticated path: the attacker needs filesystem write access to the application directory or a higher-priority location in the library search order, and the published vector indicates low privileges (PR:L) are required. The exact feature, filename, and search path that trigger the unsafe load are not described in the available sources. Limiting factors: the need for local/package access, required privileges, and the absence of any public exploit sharply reduce realistic exploitability despite the 9.9 score; fully remote exploitation is not substantiated by the described mechanism.

Signals conflict sharply here. The published CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) and 9.9 score describe a remotely exploitable, scope-changing flaw, but the description states exploitation requires 'an attacker with access to the software package,' and the weakness is CWE-427 (insecure/uncontrolled library loading). Insecure library loading is fundamentally a local DLL/shared-object planting problem, so the AV:N and S:C metrics appear inconsistent with the described mechanism - verify the attack vector with Eaton before treating this as a remote, network-reachable RCE. The defensive signals are muted: EPSS is 0.01% (0th percentile), there is no CISA KEV listing, no public PoC or exploit reference is provided, and SSVC records Exploitation: none and Automatable: no. The only strong, consistent signal is SSVC Technical Impact: total, confirming that successful exploitation yields full code execution. The vuln.today 'act_now' label and the 9.9 headline score therefore rest largely on technical impact rather than demonstrated or likely exploitation. Realistic read: this is a serious but condition-gated local code-execution flaw rather than a wormable internet-facing RCE; patching is warranted, but the probability of widespread opportunistic exploitation is currently low.

An attacker who can write files into the application's directory or an earlier entry in its library search path plants a malicious library that the Eaton IPP executable loads at startup, running attacker code in the context of the IPP process. Because IPP typically runs with elevated privileges to manage UPS hardware, this yields full compromise of the host. No public exploit code or PoC reference is provided in the available data.