EUVD-2026-51077
GHSA-6wp8-c88g-h8qm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) exploitable at low complexity but requiring an existing low-privileged account (PR:L); command injection yields full device compromise (C/I/A:H).
Primary rating from Vendor (Eaton).
CVSS VectorVendor: Eaton
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.
AnalysisAI
Privilege escalation via OS command injection affects Eaton's Tripp Lite series PADM firmware (versions 0 through 20), where a low-privileged authenticated user can abuse a session management interface that improperly validates input to gain unrestricted device access. The flaw (CWE-78) carries a CVSS 8.8 and, because the affected PADM 20 line has reached end-of-life, there is no forthcoming firmware patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
PADM is the network management/monitoring firmware embedded in Tripp Lite (Eaton) power devices such as PDUs and UPS network cards, exposing a web/management session interface over the network. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), corroborated by the vendor tags 'Command Injection' and 'Padm': one of the session management interface endpoints passes attacker-influenced input into an underlying OS command context without adequate validation. The single CPE provided, cpe:2.3:a:eaton:padm:*, confirms the affected component is the PADM application firmware itself rather than a specific hardware SKU.
RemediationAI
No vendor-released patch identified at time of analysis - the affected PADM 20 firmware line is designated end-of-life by Eaton, so remediation should focus on replacing affected Tripp Lite devices with a currently supported management card/firmware generation rather than waiting for a fix (see the EOL notice at https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/eol/secure/eaton-tripp-lite-series-padm-20-eol-notice.pdf and the advisory at https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory.pdf). Until replacement, restrict network reachability of the PADM management interface to a dedicated, isolated management VLAN and block it from general user and internet access (trade-off: legitimate remote administrators must use a jump host or VPN), enforce strong unique credentials and remove shared/default low-privilege accounts to raise the bar on the required PR:L foothold, and monitor session-management endpoints for anomalous input; these controls reduce exposure but do not eliminate the underlying command-injection flaw.
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20)
Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today