CVE-2026-22622 describes a vulnerability in Eaton's Tripp Lite series PADM firmware where improper input validation in one of the session management interfaces allows an authenticated user to escalate privileges. This results in the user obtaining unrestricted access to the device. The vulnerability is associated with CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating potential command injection or similar issues. No patch or remediation details are currently available, and no known exploits in the wild have been reported.

An authenticated user can exploit this vulnerability to elevate privileges and gain unrestricted access to the device, potentially compromising confidentiality, integrity, and availability of the device and its managed resources. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, restrict authenticated user access to trusted personnel only and monitor for unusual activity related to session management interfaces.