CVE-2019-16261 is an improper-authentication flaw (CWE-287) in Tripp Lite's PDUMH15AT power distribution unit and SU750XL UPS firmware: the device's web management interface accepts POST requests to its /Forms/ directory from anyone on the network without checking for a valid session, so a remote attacker can silently change the manager or admin password or cut power to a connected outlet with no credentials at all; NVD has published its own Primary CVSS v3.1 score of 9.1 (critical) for this flaw.
Vulnerability summary
9.1
Critical
2.8%
EPSS score (FIRST)
No
CISA KEV catalog
2019-09-12
Published
Vulnerability ID: CVE-2019-16261 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Tripp Lite PDUMH15AT PDU / SU750XL UPS firmware (web management forms) | cpe:2.3:o:tripplite:pdumh15at_firmware:12.04.0053:*:*:*:*:*:*:* | PDUMH15AT firmware 12.04.0053 and SU750XL firmware 12.04.0052, as tested; Tripp Lite's position is that a newer firmware version fixing the issue predates this report |
What does this mean for affected devices?
CVE-2019-16261 (CWE-287, improper authentication) affects the web-based management forms of Tripp Lite's PDUMH15AT power distribution unit and SU750XL uninterruptible power supply. NVD's description states: "Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet" (NVD).
The issue was publicly documented by security researcher Jason Doyle via KoreLogic's "unpatched fringe infrastructure" research blog, which walked through the unauthenticated forms on the device's embedded web server and showed that outlet power state and account passwords could both be changed by posting directly to those forms with no login step (KoreLogic). NVD's own description adds a vendor-position note: "the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053" — i.e., Tripp Lite maintains the specific firmware build that was tested predates its own fix, though no dedicated Tripp Lite/Eaton security bulletin for this CVE is referenced in NVD's record (NVD).
NVD lists a Primary CVSS v3.1 score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, sourced directly from [email protected] (plus a Primary CVSS v2.0 score of 8.5); the PR:N and UI:N components mean this is exploitable over the network with no credentials and no victim interaction at all, consistent with the unauthenticated-POST description (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.02755 (86.3rd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
Operators still running the affected PDUMH15AT or SU750XL firmware builds should update to a current Tripp Lite/Eaton firmware release and ensure the device's web management interface is never exposed directly to an untrusted network, since no authentication protects the power-control and password-change forms on the vulnerable builds.
Evidence
- Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. — NVD
- Public research write-up on KoreLogic's blog documents the unauthenticated web forms on the device, including outlet power control and password-change forms reachable with no login. — KoreLogic research blog
- NVD Primary CVSS v3.1 score 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, source [email protected]; NVD's description notes the vendor's position that a fixed firmware build predates this report. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.02755 (86.3rd percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
