CyberPower PowerPanel Business

🗓️ 02 May 2024 06:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 76 Views

CyberPower PowerPanel vulnerability. CVSS v3 9.8. Hard-coded credentials, relative path traversal, SQL injection. Successful exploitation could result in authentication bypass, administrator privileges, and code execution. Affected version: PowerPanel 4.9.0 and earlier

Reporter	Title	Published	Views	Family All 82
BDU FSTEC	The vulnerability of the PowerPanel Business’s monitoring and management system for power sources involves insufficient protection of operational data during code debugging. This allows attackers to gain unauthorized access to account information and increase their privileges.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business’s monitoring and control system regarding authentication procedures allows unauthorized access by intruders to protected information.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business monitoring and power source management system lies in the use of a strictly encrypted cryptographic key. This allows attackers to impersonate other users and send malicious data into the system.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business’s monitoring and power source management system lies in the lack of measures to protect the SQL query structure. This allows attackers to execute arbitrary SQL code and write arbitrary files.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business’s monitoring and management system for uninterruptible power sources lies in the storage of passwords in a recoverable format, which allows an intruder to gain unauthorized access to protected information.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business monitoring and power source management system, related to the use of strictly encrypted account data, allows a intruder to gain unauthorized access to protected information and enhance their privileges.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business monitoring and power source management system, related to errors in processing the relative path to the catalog, allows a perpetrator to execute arbitrary code.	6 May 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PowerPanel Business monitoring and power source management system, related to the use of pre-installed account data, allows a perpetrator to increase their privileges.	6 May 202400:00	–	bdu_fstec
Circl	CVE-2024-31409	7 Aug 202518:54	–	circl
CNNVD	Cyber Power Systems PowerPanel Business Edition 安全漏洞	15 May 202400:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-123-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-24-123-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
cisa	www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
cisa	www.cisa.gov/uscert/ncas/tips/ST04-014

02 May 2024 06:00Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8 - 9.8

EPSS0.00618

SSVC