If you're defending enterprise power infrastructure, CVE-2026-22621 on Tripp Lite PADM deserves your attention despite its CVSS 8.3 score. The score doesn't tell the full story.
The CVE describes an authenticated command execution vulnerability in a restricted environment. Don't let that language comfort you. On a PDU or UPS management interface, the restricted environment isn't a containment boundary — it's the operational plane itself. Getting code execution inside that firmware shell means you've achieved direct control over outlet state, power sequencing, load shedding, and battery management on devices that feed critical loads. There is no meaningful outside to contain you within; executing code in that context doesn't mean you've hit a boundary that limits blast radius — it means you ARE the blast radius.
The authentication requirement is weaker than it appears. Tripp Lite power devices have a documented history of default credentials persisting in deployments, infrequent firmware updates, and administrative interfaces exposed in network segments where segmentation assumptions are optimistic. On legacy power infrastructure, authenticated often just means anyone who can reach the interface — the barrier is thinner than the CVE language implies.
What makes this dangerous: once an attacker has admin-level access to a PDU management interface, they've effectively already accomplished their operational objective. The post-auth primitive enables the lateral movement, power manipulation, and physical consequence chain that matters. In documented OT incidents, compromised PDUs have been used to disable cooling before deploying ransomware, creating cascading failures across infrastructure.
The remediation reality compounds the risk. Enterprise power infrastructure operates on decade-long deployment cycles. You cannot patch a PDU serving a critical load without physical redundancy in place first. The window between disclosure and actual remediation isn't weeks — it's maintenance windows and change advisory board cycles.
What to check now: inventory all Tripp Lite PADM deployments, verify they're not exposed to untrusted network segments, confirm admin credentials have been changed from defaults, and assess whether you have the physical redundancy to take them offline when a patch becomes available.