Tripp Lite PADM CVE-2026-22622

Exploitation requires a valid low-privileged authenticated session on the PADM device (CVSS PR:L) and network reachability to the specific session management interface endpoint; the attacker then leverages improper input validation in that interface to inject OS commands and escalate to unrestricted access. Limiting factors: the attacker must already hold credentials (not remote-unauthenticated), and only PADM firmware versions 0 through 20 are affected, with the interface needing to be network-accessible to the attacker. No user interaction is required (UI:N) and attack complexity is low (AC:L) once authenticated.

The signals are largely internally consistent and point to a genuine, high-severity issue rather than an inflated CVSS: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack that nonetheless requires an existing low-privileged authenticated session (PR:L), and full C:H/I:H/A:H reflects the described 'unrestricted access.' No EPSS score, no SSVC decision data, and no KEV or POC data were supplied, so exploitation likelihood cannot be quantified from probabilistic sources - the assessment rests on the CVSS vector and vendor description alone. The key tempering factor is that PR:L requires valid credentials, so realistic risk is highest where the PADM interface is exposed to many low-trust users or where credentials are weak/shared; the offsetting aggravator is that PADM 20 is end-of-life, meaning no patch will close the gap.

An attacker who has obtained any low-privileged PADM account - via credential reuse, a shared operator login, or an insider - connects to the network-exposed session management interface and submits crafted input to the vulnerable parameter, injecting OS commands that execute with elevated privilege. This yields unrestricted control of the power-management device, letting the attacker alter power states, tamper with monitoring, or pivot within the OT/management network. No public exploit code was identified, so an attacker would need to develop the injection payload themselves.