A misconfigured HTTP response header in Eaton Intelligent Power Protector (IPP) exposes users to web‑based attacks. The software sets an insecure attribute in the HTTP header, allowing attackers to manipulate browser behavior, such as clickjacking or other browser exploitation. This weakness is represented by CWE‑358, indicating improper handling of HTTP header values.

Eaton Intelligent Power Protector, the industrial power management software that exposes a web interface. The advisory notes that the issue is fixed in the latest release available from Eaton’s download centre, but specific version numbers are not listed, so all Internet‑connected IPP deployments should be treated as potentially affected until the patch is applied.

The CVSS score of 5.9 indicates a moderate severity, and the lack of an EPSS score along with the absence from the CISA KEV catalog suggests that widespread exploitation is unlikely at present. Attackers would need remote access to the IPP’s web interface to exploit the header, making the risk moderate but non‑negligible. Organizations should assess whether the device is exposed to the public network and prioritize remediation accordingly.