CVE-2026-22620 describes a vulnerability in Eaton's Tripp Lite series PADM firmware where improper input validation in the authentication component enables an unauthenticated remote attacker to bypass authentication controls. This vulnerability allows the attacker to gain privileged user access to the device. The CVSS 3.1 vector indicates the attack can be performed remotely with low attack complexity, no privileges, and no user interaction required, resulting in low confidentiality and integrity impact but high availability impact. The vulnerability is associated with CWE-89, which typically relates to injection flaws, suggesting the input validation issue may involve injection attacks.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication and obtain privileged user access to the device. This can lead to unauthorized control, potential disruption of device availability, and compromise of device confidentiality and integrity to a lesser extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict network access to the affected devices and monitor for unusual authentication bypass attempts.