CyberPower PowerPanel Business
Successful exploitation of these vulnerabilities could result in an attacker bypassing authentication and gaining administrator privileges, forging JWT tokens to bypass authentication, writing arbitrary files to the server and acheiving code execution, gaining access to services with the privileges of a Powerpanel Business application, gaining access to the testing or production server, learning passwords and authenticating with user or administrator privileges, injecting SQL syntax, writing arbitrary files to the system, executing remote code, impersonating any client in the system and sending malicious data, or obtaining data from throughout the system after gaining access to any device.
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-34025US | —OT elevated | — | ||
CyberPower PowerPanel business application code contains a hard-coded set of authentication
credentials. This could result in an attacker bypassing authentication
and gaining adm… | ||||
| CVE-2024-33625US | —OT elevated | — | ||
CyberPower PowerPanel business
application code contains a hard-coded JWT signing key. This could
result in an attacker forging JWT tokens to bypass authentication. | ||||
| CVE-2024-33615US | — | — | ||
A specially crafted Zip file containing path traversal characters can be
imported to the
CyberPower PowerPanel
server, which allows file writing to the server outside
the inte… | ||||
| CVE-2024-32053US | —OT elevated | — | ||
Hard-coded credentials are used by the
CyberPower PowerPanel
platform to authenticate to the
database, other services, and the cloud. This could result in an
attacker gaining… | ||||
| CVE-2024-32047US | —OT elevated | — | ||
Hard-coded credentials for the
CyberPower PowerPanel test server can be found in the
production code. This might result in an attacker gaining access to the
testing or productio… | ||||
| CVE-2024-32042US | high7.5 | — | ||
The key used to encrypt passwords stored in the database can be found in
the
CyberPower PowerPanel
application code, allowing the passwords to be recovered. | ||||
| CVE-2024-31856US | high8.8 | — | ||
An attacker with certain MQTT permissions can create malicious messages
to all CyberPower PowerPanel devices. This could result in an attacker injecting
SQL syntax, writing arbit… | ||||
| CVE-2024-31410US | medium6.5OT elevated | — | ||
The devices which CyberPower PowerPanel manages use identical certificates based on a
hard-coded cryptographic key. This can allow an attacker to impersonate
any client in the sy… | ||||
| CVE-2024-31409US | high7.5OT elevated | — | ||
Certain MQTT wildcards are not blocked on the
CyberPower PowerPanel
system, which might result in an attacker obtaining data from throughout the system after gaining access to an… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-123-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-123-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (9)
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
- FixedPowerPanel Business
CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities:
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan