This vulnerability stems from insufficient input validation in the XML used by Eaton Intelligent Power Protector. An attacker who has administrative privileges and can reach the local system can inject malicious content that is executed as system commands. The impact is that the attacker can perform arbitrary actions with the same rights as the local administrator, potentially compromising system integrity and confidentiality.

The affected product is Eaton Intelligent Power Protector (IPP). No version details are specified, but the issue has been fixed in the most recent release available from Eaton’s download centre.

The CVSS score of 6 indicates moderate severity, and an EPSS score is not listed, suggesting no publicly known exploitation data. The flaw is not in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local administrator access, so it is not a remote threat but would allow a privileged user to execute arbitrary commands. The risk is moderate for environments where administrators have unchecked local access to IoT or embedded devices.