Eaton Intelligent Power Protector software stores authentication information in cookies that lack secure attributes, making the cookie visible to traffic snoops. An attacker who can observe network traffic could intercept the cookie and use it to impersonate a legitimate user or execute operations on the device. This vulnerability directly jeopardizes confidentiality and authenticity of the device’s session data.

The vulnerability affects Eaton Intelligent Power Protector (IPP) devices. The product details mention a publicly released patch that addresses the insecure cookie handling. No specific firmware or software versions are listed in the data, so all IPP installations are potentially susceptible until they apply the latest update.

The CVSS score of 5.7 indicates a moderate severity. There is no EPSS score provided, and the issue is not in the CISA KEV catalog, suggesting that documented exploitation is unknown at this time. Nevertheless, because the flaw relies on traffic interception, any network path that the attacker can access could be sufficient to replay the cookie, especially if HTTPS is not enforced. The attack vector is inferred to be network-based MITM. Organizations using IPP should assume the risk until the fix is applied.