by Kastro
Paper/Archive/CVE-2024-32047

CVE-2024-32047

CyberPower PowerPanel business — CyberPower PowerPanel business Active Debug Code

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.7.437 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server.

Affected

ProductAffectedFixed inSource
PowerPanel business< 4.9.04.9.0CNA
powerpanel_business< 4.9.04.9.0CISA-ADP

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-123-01refcyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads