What is the CVSS score of CVE-2026-22621?

CVE-2026-22621 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.6%.

Which versions of Tripp Lite PADM are affected by CVE-2026-22621?

Eaton's Tripp Lite Series PADM firmware (versions 0-20) contains a command injection vulnerability allowing authenticated administrators to execute arbitrary operating system commands on affected…

How to fix or mitigate CVE-2026-22621?

Within 24 hours: Conduct a complete inventory of all deployed Tripp Lite PADM devices, document firmware versions, and audit which administrative accounts have access to each device-remove any unnecessary privileges or unused credentials. Within 7 days: Segment PADM management interfaces onto an isolated administrative network with restricted ingress; enable session and command audit logging with automated monitoring for shell metacharacters and suspicious input patterns. Within 30 days: Execute hardware replacement for all affected PADM units, prioritizing devices managing critical power circuits or those with multi-user administrative access; complete replacement represents the only sustainable remediation.

Tripp Lite PADM CVE-2026-22621

EUVD-2026-51076 HIGH

OS Command Injection (CWE-78)

2026-07-30 Eaton

GHSA-pwxm-3jqh-j7gq

Command Injection Padm Eaton

8.3

CVSS 3.1 · Vendor: Eaton

Severity by source

Vendor (Eaton) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

6.7 MEDIUM

Description requires an authenticated administrator, so PR:H rather than the published PR:L; network-reachable low-complexity command injection yields high C/I and partial A within the restricted environment.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Eaton).

CVSS VectorVendor: Eaton

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 11:20 vuln.today

CVE Published

Jul 30, 2026 - 10:16 cve.org

HIGH 8.3

DescriptionCVE.org

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.

AnalysisAI

Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator run arbitrary operating-system commands through a session-management interface that fails to properly validate input, escaping the intended restricted command environment. The flaw carries CVSS 8.3 (CWE-78) and is notable because the affected firmware line is end-of-life, meaning no security updates are being produced. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation currently requires an actor who already holds administrative credentials on the device.

Technical ContextAI

PADM is the firmware powering Tripp Lite's network management/PDU-and-UPS management interface (CPE cpe:2.3:a:eaton:padm), used to remotely monitor and control power distribution equipment. The root cause is CWE-78 (OS Command Injection): the session-management interface concatenates attacker-influenced input into a command executed by the underlying OS shell without sufficient sanitization, allowing shell metacharacters or command fragments to break out of the intended restricted CLI/menu. Because the interface is reachable over the network and the device runs an embedded Linux-style OS, a successful injection yields command execution in the device's operating context rather than the confined management shell.

RemediationAI

No vendor-released patch version was identified at time of analysis, and Eaton's own documentation marks the PADM 20 firmware line as end-of-life, so the primary remediation is device/firmware migration: replace affected Tripp Lite PADM units with a currently supported Eaton management card or product line per the EOL notice (https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/eol/secure/eaton-tripp-lite-series-padm-20-eol-notice.pdf) and follow guidance in the security advisory (https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory.pdf). Because exploitation requires administrative authentication over the network, the most effective compensating controls are to isolate the management interface on a dedicated management VLAN or OT segment, restrict its reachability with firewall/ACL rules so only trusted management hosts can reach the session-management interface (trade-off: legitimate remote admins must connect via the jump host/VPN), and rotate/harden administrator credentials and disable unused admin accounts to shrink the set of actors who can trigger the flaw. Monitor the interface for anomalous command activity, accepting that on EOL firmware these controls reduce but do not eliminate exposure.