EUVD-2026-51075
GHSA-6ghg-p2q3-j73x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PADM management interface over network
-
DeliverySend crafted login with SQL injection payload
-
ExploitSubvert authentication query logic
-
ExecutionObtain privileged user session
-
ImpactControl power-distribution device / pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker only needs network reachability to the PADM authentication/management interface; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration is required, so default deployments exposing the management interface are exploitable. The concrete prerequisite is that the device's SQL-backed authentication endpoint is network-accessible to the attacker. Limiting factors: exploitation is confined to whatever network the management interface is exposed on - devices isolated on a segmented/non-routable management VLAN or behind restrictive firewall ACLs are not reachable, which is the main realistic constraint on exploitation. Affected scope is limited to PADM firmware versions 0 through 20. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, score 8.6) signals a low-complexity, network-reachable, unauthenticated attack - the most exploitable end of the spectrum - and the description ('gain a privileged user access') implies impact considerably higher than the vector's C:L/I:L rating; a full authentication bypass to a privileged account typically warrants high confidentiality and integrity impact, so the supplied vector appears to under-rate C and I (verify with vendor). No EPSS score, no KEV listing, and no POC were provided, so exploitation is currently theoretical from an intelligence standpoint: no public exploit identified at time of analysis. However, SQLi auth-bypass bugs are historically easy to weaponize and this class is frequently automated. The overriding aggravating factor is that the affected product is end-of-life (per Eaton's PADM 20 EOL notice), meaning affected devices may never receive a firmware fix - elevating this from a patch-and-move-on item to a device-replacement/network-isolation decision. |
| Exploit ScenarioDerived | An attacker who can reach the PADM management interface over the network sends a crafted authentication request containing an SQL injection payload in a login field, causing the backend query to return a privileged session without valid credentials. With low attack complexity and no authentication or user interaction required, the attacker obtains privileged device access and can manipulate power-distribution settings or use the device as a foothold. No public POC was provided, but the SQLi auth-bypass pattern is straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.
RemediationAI
No vendor-released patch version was identified in the provided data, and the affected PADM firmware is end-of-life (Eaton PADM 20 EOL notice), so the primary remediation is to plan device replacement/migration to a supported Eaton management platform rather than await a firmware update; consult the Eaton security bulletin (https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory.pdf) and the EOL notice for the vendor's recommended successor. As compensating controls until replacement: remove the device management interface from any internet-facing exposure and place it on an isolated management VLAN reachable only from a trusted admin jump host (trade-off: legitimate remote monitoring must route through that host); restrict access to the authentication/web-management endpoint via firewall ACLs to specific admin source IPs (trade-off: breaks broad NMS polling); and enforce network segmentation so a compromised PDU cannot pivot into OT/production networks. Because the flaw bypasses authentication itself, credential-based hardening (stronger passwords, MFA at the app layer) will not mitigate it - network-level access restriction is the effective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PADM is the embedded management firmware for Eaton's Tripp Lite line of power distribution / UPS-class network devices (CPE cpe:2.3:a:eaton:padm), exposing a web/management interface for monitoring and control. The assigned weakness class is CWE-89 (SQL Injection) and the vendor tags reinforce 'SQLi', indicating the authentication component builds a database query from unsanitized user-supplied login input. By injecting SQL into an authentication field, an attacker can manipulate the query logic so the backend returns a valid/privileged session without valid credentials - a classic auth-bypass-via-SQLi pattern where the root cause is improper input validation rather than a credential or session-management flaw.
Know when Padm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Unauthenticated, low-complexity network SQLi that bypasses auth to a privileged account yields full C/I/A impact, so PR:N/AC:L with C:H/I:H/A:H rather than the vendor's under-rated C:L/I:L.
Primary rating from Vendor (Eaton).
CVSS VectorVendor: Eaton
DescriptionCVE.org
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
Executive ViewAI
Eaton Tripp Lite PADM power-distribution management firmware contains an authentication bypass vulnerability (CVE-2026-22620, CVSS 8.6) that allows unauthenticated remote attackers to gain privileged access to affected devices. No vendor patch is available, and the product is end-of-life, creating persistent critical exposure for any organization still operating these units in production environments.
Since no vendor-released patch is identified, implement: (1) strict network segmentation isolating affected devices to trusted administrative networks; (2) disable remote access and enforce local console-only management where feasible; (3) restrict IP-level access via firewall rules to known administrative hosts; (4) enable and actively monitor authentication logging for anomalies; (5) perform regular configuration audits and ensure privileged credentials are rotated; (6) accelerate replacement with actively supported alternatives as the primary long-term control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Privilege escalation via OS command injection affects Eaton's Tripp Lite series PADM firmware (versions 0 through 20), w
Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator
Exploit-DB