Alongside our client work, ivision spends time on security research. We pick things that interest us, take them apart, and report what we find to the vendor. We do it because we enjoy it, and because what we learn feeds back into the work we do for customers.

Our research focused on the Tripp Lite LX series of power management devices, which Eaton sells for data centers and offices. The series includes rack-mounted power strips that let administrators switch individual outlets on and off remotely, battery backup units that keep equipment running through an outage, and sensors that report conditions such as temperature and humidity. Rather than maintain separate software for each product line, the series runs common management firmware called PowerAlert Device Manager (PADM), which provides the network-based management interfaces used to administer the devices.

We identified three vulnerabilities in PADM version 15.5.7 (build 1094). Each is useful on its own, but chained together they give an unauthenticated attacker with network access unrestricted root code execution on devices.

We reported the vulnerabilities to Eaton’s Product Security Incident Response Team on January 16, 2026. On July 28, 2026, Eaton published advisory ETN-VA-2026-1005 and allocated three CVEs:

As described in their advisory, Eaton has chosen to end-of-life the PADM firmware, effective March 31, 2026, and will not be patching these issues. That decision covers the whole line, both 15.x and 20.x, so no version of PADM will receive further updates.

The advisory also does not say which versions are affected. Our work was confined in PADM 15.5.7, and without a definitive list, owners should assume that all prior 15.x releases are vulnerable. We did not assess PADM 20.x, and so are unable to provide confirmation for whether this version is affected as well.

If you operate devices running PADM firmware, ensure that adequate network controls are in place and that the devices are only reachable by trusted hosts. Where possible, disable the web-based and SSH-based management interfaces to reduce exposure. Fuller detail is in the mitigation guidance below.

Because no fix is available, this post describes the issues only at the level needed for owners to understand their exposure and take protective steps. We’ll follow up later with an in-depth technical description of the vulnerabilities and how we found them.

The vulnerabilities

Authentication bypass in the web management API via SQL injection (CVE-2026-22620)

PADM provides a web-based UI, enabled by default, which is driven by an API running on the device. We found that the API was vulnerable to unauthenticated SQL injection, and that the flaw could be used to issue a valid session token for an administrator account, bypassing authentication to the UI. With that access, an attacker could exercise the full set of management operations: power control, user creation, and enabling additional services.

Once administrator access is gained, an attacker could create a new administrator account with a known password and enable the device’s SSH management interface if it was not already running. Logging in over SSH with that account, they could then chain the two issues described below to gain full root access.

Command injection in SSH management interface and local privilege escalation to root (CVE-2026-22621, CVE-2026-22622)

PADM provides a text-based management CLI over SSH for administrator users. It is not a shell, and users are not meant to be able to run shell commands from it.

Improper sanitization and escaping of user-supplied input allowed shell commands to be executed anyway. Two measures were in place to limit what those commands could do: they were executed as an unprivileged user account, and they were confined to a chroot environment containing a minimal set of binaries.

Neither measure was effective. We found that the chroot environment was constructed in a way that allowed it to be escaped, and that a separate input sanitization issue in the same code path allowed commands to be executed as root rather than as the unprivileged account. Together, these gave us unrestricted root access to the underlying system.

Affected products and versions

Our research was done against PADM 15.5.7 (build 1094) running on a PDU15NETLX network-connected power distribution unit. PADM is common firmware across the Tripp Lite LX series, so we expect these vulnerabilities affect other products in the series, including Tripp Lite UPSes, environmental monitoring systems, and devices that integrate the WEBCARDLXE network management card.

During our communication with Eaton PSIRT, we attempted to obtain a listing of firmware versions and products affected by these issues, but we were ultimately unsuccessful in doing so. Their advisory does not specify which versions are affected either, so in the absence of a definitive list, users are advised to operate under the assumption that all 15.x versions are vulnerable.

At the time of our research, we did not have access to devices running PADM 20.x, so we could not assess whether that version is similarly affected.

Mitigation

Eaton’s advisory states that no security update will be made available to address these issues, and support for both PADM 15.x and 20.x has been discontinued.

If you operate devices running PADM 15, ivision recommends the following to reduce exposure:

  • Restrict network access so that management interfaces are reachable only from a small set of trusted administrative hosts, ideally on an isolated management network.
  • Disable the web-based and SSH management interfaces where they are not required. Both interfaces are enabled by default.
  • Treat any device running PADM 15 as offering root access to every host that can reach its management interfaces, and position it on your network accordingly.

These steps reduce exposure but do not eliminate it. Because Eaton has discontinued support for all versions of PADM firmware, a plan should ultimately be made to retire or replace these devices.

Disclosure timeline

  • 2026-01-16 - Reported three vulnerabilities to Eaton PSIRT
  • 2026-01-19 - Eaton PSIRT confirmed receipt
  • 2026-02-16 - ivision requested a status update and asked about Eaton’s plans for issuing a public advisory
  • 2026-03-16 - Eaton PSIRT confirmed removal of the affected firmware from its download page
  • 2026-05-21 - ivision notified Eaton of intent to publish on 2026-06-22, offering up to 30 additional days to coordinate
  • 2026-05-26 - Eaton PSIRT requested the opportunity to review the publication
  • 2026-06-18 - ivision asked Eaton for affected products and versions, patch plans, mitigation guidance, and PSIRT advisory plans. Moved the publication target to 2026-07-21
  • 2026-07-09 - ivision sent a draft of the technical post to Eaton PSIRT for review
  • 2026-07-21 - Eaton PSIRT responded, stating end-of-life status, no planned patches
  • 2026-07-22 - ivision asked whether Eaton intended to publish an advisory
  • 2026-07-24 - Eaton PSIRT confirmed an advisory was planned
  • 2026-07-28 - Eaton published advisory ETN-VA-2026-1005
  • 2026-07-30 - CVE-2026-22620, CVE-2026-22621, and CVE-2026-22622 published

References