by Kastro
Paper/Archive/CVE-2024-32735

CVE-2024-32735

CyberPower CyberPower PowerPanel Enterprise — CyberPower PowerPanel Enterprise Missing Authentication

EPSS 7%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.0.940 × 2018.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.

Affected

ProductAffectedFixed inSource
CyberPower PowerPanel Enterprise< 2.8.32.8.3CNA
powerpanel_enterprise< 2.8.32.8.3CISA-ADP

Scores by source

tenable (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reftenable.com/security/research/tra-2024-14refcyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote