{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22619", "assignerOrgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "state": "PUBLISHED", "assignerShortName": "Eaton", "dateReserved": "2026-01-08T04:55:11.730Z", "datePublished": "2026-04-16T05:26:48.952Z", "dateUpdated": "2026-04-16T05:26:48.952Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "63703b7d-23e2-41ef-94b3-a3c6333f7759", "shortName": "Eaton", "dateUpdated": "2026-04-16T05:26:48.952Z"}, "affected": [{"vendor": "Eaton", "product": "IPP software", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package.\u00a0This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download center.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package.&nbsp;<span>This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download center.</span></div>"}]}], "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package.\u00a0This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download center."}], "id": "CVE-2026-22619", "lastModified": "2026-04-16T06:16:10.413", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "CybersecurityCOE@eaton.com", "type": "Secondary"}]}, "published": "2026-04-16T06:16:10.413", "references": [{"source": "CybersecurityCOE@eaton.com", "url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1025.pdf"}], "sourceIdentifier": "CybersecurityCOE@eaton.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "IPP software", "source": "cna", "vendor": "Eaton"}, "product": "ipp_software", "vendor": "eaton"}], "analysis": {"en": {"generated_at": "2026-04-16T08:56:58.461998+00:00", "value": {"mitigation_remediation": ["Upgrade the Eaton Intelligent Power Protector to the latest version available on the Eaton download center.", "Restrict write access to the installation directory and the executable to prevent tampering with the library loading process.", "Verify that all incoming software packages are sourced from trusted, authenticated channels and validate their integrity before deployment."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is Eaton Intelligent Power Protector (IPP). Specific version information is not disclosed in the advisory; the issue exists in earlier releases before the latest available update.", "description_and_impact": "The vulnerability arises from insecure library loading in the Eaton Intelligent Power Protector executable. This weakness allows an attacker who can supply or modify the software package to load arbitrary libraries, resulting in execution of malicious code. The primary consequence is full code execution on the affected system, potentially giving an attacker control over the device and compromising integrity and confidentiality.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high level of severity. No EPSS score is provided, so the current probability of exploitation in the wild is unspecified. The vulnerability has not been reported in the CISA KEV catalog. The likely attack vector requires the attacker to have access to the software package or installation media, implying a local or supply\u2011chain scenario. Once the vulnerable library is loaded, the attacker can execute arbitrary code with the privileges of the IPP process."}}}}, "created": "2026-04-16T06:30:05.893379+00:00", "title": "Insecure Library Loading in Eaton Intelligent Power Protector Leading to Arbitrary Code Execution", "updated": "2026-04-16T09:00:05.293199+00:00", "vendors": ["eaton", "eaton$PRODUCT$ipp_software"], "weaknesses": ["CWE-917"]}