Description
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
Published: 2026-07-30
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper input validation flaw in the authentication component of Eaton Tripp Lite PADM firmware. This flaw allows an unauthenticated remote attacker to supply crafted input that bypasses login controls and gains privileged user access to the device. The issue is classified as CWE-89.

Affected Systems

Eaton Tripp Lite PADM firmware is affected. No specific firmware build or release numbers are disclosed, so all deployments of the PADM firmware are potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.6 classifies the issue as high severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the network: an unauthenticated remote attacker can trigger the authentication bypass by sending specially crafted input to the device’s login interface. Successful exploitation results in privileged administrative control of the device.

Generated by OpenCVE AI on August 4, 2026 at 11:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest PADM firmware update released by Eaton that fixes the authentication bypass flaw.
  • If an updated firmware is not yet available, restrict external network access to the PADM by configuring firewall rules or access‑control lists to allow traffic only from trusted IP ranges.
  • Disable or tightly restrict any remote management interfaces on the PADM, ensuring that only authenticated users can access management functions and that secure authentication methods are enforced.

Generated by OpenCVE AI on August 4, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass via Improper Input Validation in Eaton Tripp Lite PADM Firmware

Fri, 31 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass via Improper Input Validation in Eaton Tripp Lite PADM Firmware

Fri, 31 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
References

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Eaton
Eaton padm
Vendors & Products Eaton
Eaton padm

Thu, 30 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Description Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Eaton Padm
cve-icon MITRE

Status: PUBLISHED

Assigner: Eaton

Published:

Updated: 2026-07-31T09:55:01.109Z

Reserved: 2026-01-08T04:55:11.730Z

Link: CVE-2026-22620

cve-icon Vulnrichment

Updated: 2026-07-30T12:24:25.999Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-30T11:16:27.130

Modified: 2026-07-31T11:17:08.000

Link: CVE-2026-22620

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:00:10Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')