by Kastro
Paper/Archive/CVE-2024-32053

CVE-2024-32053

CyberPower PowerPanel business — CyberPower PowerPanel business Use of Hard-coded Credentials

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.0.410 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Hard-coded credentials are used by the  CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel business application.

Affected

ProductAffectedFixed inSource
PowerPanel business< 4.9.04.9.0CNA
powerpanel_business< 4.9.04.9.0CISA-ADP

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-123-01refcyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads