CVE-2026-22617

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-614

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-226187.1A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecur CVE-2026-226199.9Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut CVE-2026-22627.5The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via CVE-2026-226208.6Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote a CVE-2026-226218.3Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated CVE-2026-226228.8Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated CVE-2026-226237.2Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary c CVE-2026-226244.3Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without pro CVE-2026-226254.6Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.CVE-2026-226264.9Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal devi CVE-2026-226278.8A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 ma CVE-2026-226286.7An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute syst