The vulnerability of the PowerPanel Business monitoring and power source management system, related to the use of pre-installed account data, allows a perpetrator to increase their privileges.

The vulnerability of the PowerPanel Business monitoring and power source management system is related to the use of pre-installed account data. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

The vulnerability of the PowerPanel Business’s monitoring and control system regarding authentication procedures allows unauthorized access by intruders to protected information.

The vulnerability of the PowerPanel Business monitoring and power source management system is related to deficiencies in authentication procedures, due to the absence of blocking mechanisms for substitution signs. Exploiting this vulnerability could allow an attacker operating remotely to gain...

The vulnerability of the PowerPanel Business’s monitoring and power source management system lies in the lack of measures to protect the SQL query structure. This allows attackers to execute arbitrary SQL code and write arbitrary files.

The vulnerability of the PowerPanel Business monitoring and power source management system lies in the lack of measures taken to protect the SQL query structure during the processing of MQTT messages. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code and write...

The vulnerability of the PowerPanel Business monitoring and power source management system, related to the use of strictly encrypted account data, allows a intruder to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the PowerPanel Business monitoring and power source management system lies in the use of strictly encrypted account data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information and enhance their privileg...

CyberPower PowerPanel Business

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: CyberPower Equipment: PowerPanel business Vulnerabilities: Use of Hard-coded Password, Relative Path Traversal, Use of Hard-coded Credentials, Active Debug Code, Storing Passwords in a...

PT-2024-3241 · Cyberpower · Cyberpower Powerpanel

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel affected versions not specified Description: The issue is related to the processing of relative paths in the PowerPanel system, which can be exploited by importing a specially crafted Zip file containing path traversal...

PT-2024-3240 · Cyberpower · Cyberpower Powerpanel

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel affected versions not specified Description: The issue is related to hard-coded credentials used by the CyberPower PowerPanel platform for authentication to the database, other services, and the cloud. This could allow a...

PT-2024-3239

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel affected versions not specified Description The issue concerns the storage of passwords in a recoverable format within the PowerPanel system. This is due to the encryption key being accessible in the application code,...

PT-2024-3242 · Cyberpower · Cyberpower Powerpanel

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel business application affected versions not specified Description: The issue is related to a hard-coded set of authentication credentials in the CyberPower PowerPanel business application code. This could allow an attacke...

PT-2024-3238 · Cyberpower · Cyberpower Powerpanel Business

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Business affected versions not specified Description: The issue is related to the lack of protection for the SQL query structure when processing MQTT messages. This could allow a remote attacker to execute arbitrary SQL...

PT-2024-3237 · Cyberpower · Cyberpower Powerpanel

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel affected versions not specified Description: The issue is related to the use of a hard-coded cryptographic key in the system, which allows an attacker to impersonate any client and send malicious data. This can be...

PT-2024-3236 · Cyberpower · Cyberpower Powerpanel

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel affected versions not specified Description: The issue is related to the CyberPower PowerPanel system, where certain MQTT wildcards are not blocked, potentially allowing an attacker to obtain data from throughout the...

PT-2024-6574 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise versions prior to 2.8.3 Description: A sql injection vulnerability exists in the query ptask lean function within MCUDBHelper, allowing an unauthenticated remote attacker to leak sensitive information. The...

CyberPower PowerPanel Enterprise Detection

Binary data cyberpowerppedetect.nbin...

CyberPower PowerPanel Enterprise Authentication Bypass (CVE-2023-3265)

Binary data cyberpowerppecve-2023-3265.nbin...

CVE-2023-3266

A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an...

CVE-2023-3267

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with...

CVE-2023-3267

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with...

CVE-2023-3265

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this...

CVE-2023-3265

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this...