Eaton’s Tripp Lite Series PADM firmware contains improper input validation in the session management interface, allowing an authenticated administrator to inject and run arbitrary shell commands within a restricted environment. This weakness qualifies as CWE‑78, an input validation flaw that results in remote code execution from the perspective of the authenticated user.

The affected product is Eaton PADM firmware used in Tripp Lite Series backup devices. No specific firmware revision or version is listed in the advisory, so all installations of this firmware are potentially vulnerable.

The CVSS score of 8.3 indicates high severity. The EPSS score of < 1% suggests a low but nonzero exploitation probability. The lack of a KEV listing does not reduce the inherent risk; exploitation requires administrative credentials to access the session management interface. An attacker who can authenticate as an administrator can execute commands that may compromise device integrity and the systems it powers.