Padm
Monthly
Privilege escalation via OS command injection affects Eaton's Tripp Lite series PADM firmware (versions 0 through 20), where a low-privileged authenticated user can abuse a session management interface that improperly validates input to gain unrestricted device access. The flaw (CWE-78) carries a CVSS 8.8 and, because the affected PADM 20 line has reached end-of-life, there is no forthcoming firmware patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator run arbitrary operating-system commands through a session-management interface that fails to properly validate input, escaping the intended restricted command environment. The flaw carries CVSS 8.3 (CWE-78) and is notable because the affected firmware line is end-of-life, meaning no security updates are being produced. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation currently requires an actor who already holds administrative credentials on the device.
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.
Privilege escalation via OS command injection affects Eaton's Tripp Lite series PADM firmware (versions 0 through 20), where a low-privileged authenticated user can abuse a session management interface that improperly validates input to gain unrestricted device access. The flaw (CWE-78) carries a CVSS 8.8 and, because the affected PADM 20 line has reached end-of-life, there is no forthcoming firmware patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Command injection in Eaton's Tripp Lite Series PADM firmware (versions 0 through 20) lets an authenticated administrator run arbitrary operating-system commands through a session-management interface that fails to properly validate input, escaping the intended restricted command environment. The flaw carries CVSS 8.3 (CWE-78) and is notable because the affected firmware line is end-of-life, meaning no security updates are being produced. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation currently requires an actor who already holds administrative credentials on the device.
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.