EUVD-2026-51075
GHSA-6ghg-p2q3-j73x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Unauthenticated, low-complexity network SQLi that bypasses auth to a privileged account yields full C/I/A impact, so PR:N/AC:L with C:H/I:H/A:H rather than the vendor's under-rated C:L/I:L.
Primary rating from Vendor (Eaton).
CVSS VectorVendor: Eaton
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
AnalysisAI
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.
Technical ContextAI
PADM is the embedded management firmware for Eaton's Tripp Lite line of power distribution / UPS-class network devices (CPE cpe:2.3:a:eaton:padm), exposing a web/management interface for monitoring and control. The assigned weakness class is CWE-89 (SQL Injection) and the vendor tags reinforce 'SQLi', indicating the authentication component builds a database query from unsanitized user-supplied login input. By injecting SQL into an authentication field, an attacker can manipulate the query logic so the backend returns a valid/privileged session without valid credentials - a classic auth-bypass-via-SQLi pattern where the root cause is improper input validation rather than a credential or session-management flaw.
RemediationAI
No vendor-released patch version was identified in the provided data, and the affected PADM firmware is end-of-life (Eaton PADM 20 EOL notice), so the primary remediation is to plan device replacement/migration to a supported Eaton management platform rather than await a firmware update; consult the Eaton security bulletin (https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory.pdf) and the EOL notice for the vendor's recommended successor. As compensating controls until replacement: remove the device management interface from any internet-facing exposure and place it on an isolated management VLAN reachable only from a trusted admin jump host (trade-off: legitimate remote monitoring must route through that host); restrict access to the authentication/web-management endpoint via firewall ACLs to specific admin source IPs (trade-off: breaks broad NMS polling); and enforce network segmentation so a compromised PDU cannot pivot into OT/production networks. Because the flaw bypasses authentication itself, credential-based hardening (stronger passwords, MFA at the app layer) will not mitigate it - network-level access restriction is the effective control.
Privilege escalation via OS command injection affects Eaton's Tripp Lite series PADM firmware (versions 0 through 20), w
Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today