CVE-2026-22615

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command execution. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-226167.5Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffi CVE-2026-226177.4Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the c CVE-2026-226187.1A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecur CVE-2026-226199.9Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut CVE-2026-22627.5The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via CVE-2026-226208.6Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote a CVE-2026-226218.3Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated CVE-2026-226228.8Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated CVE-2026-226237.2Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary c CVE-2026-226244.3Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without pro CVE-2026-226254.6Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.CVE-2026-226264.9Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal devi