Eaton Intelligent Power Protector (IPP) software permits repeated authentication attempts against its web interface login page because rate-limiting controls are inadequate. This flaw enables a brute-force approach that could allow an attacker to guess valid credentials and gain unauthorized access to the device’s configuration and monitoring functions.

Eaton:IPP Software, specifically the Eaton Intelligent Power Protector product. All releases prior to the most recent update are affected; the issue was resolved in the latest version available from the Eaton download centre.

The CVSS score of 6.5 indicates moderate severity, but the EPSS metric is not available, so precise exploitation probability remains unknown. The vulnerability has not been reported in the CISA KEV catalog. The likely attack vector is the publicly accessible web interface, which, if exposed to the Internet or a wide internal network, gives an attacker significant opportunity to launch repeated login attempts. Due to the lack of rate limitation, a determined attacker could potentially discover valid credentials, leading to unauthorized control of the device.