CVE-2024-33625

CyberPower PowerPanel businessapplication code contains a hard-coded JWT signing key. This couldresult in an attacker forging JWT tokens to bypass authentication.

CVE-2024-31409

Certain MQTT wildcards are not blocked on theCyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.

CVE-2024-32047

Hard-coded credentials for theCyberPower PowerPanel test server can be found in theproduction code. This might result in an attacker gaining access to thetesting or production server.

CVE-2024-31410

The devices which CyberPower PowerPanel manages use identical certificates based on ahard-coded cryptographic key. This can allow an attacker to impersonateany client in the system and send malicious data.

CVE-2024-31856

An attacker with certain MQTT permissions can create malicious messagesto all CyberPower PowerPanel devices. This could result in an attacker injectingSQL syntax, writing arbitrary files to the system, and executing remotecode.

CVE-2023-25131

Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and e...

CVE-2024-32053

Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to thedatabase, other services, and the cloud. This could result in anattacker gaining access to services with the privileges of a Powerpanelbusiness application.

CVE-2023-25132

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Busine...

CVE-2024-32042

The key used to encrypt passwords stored in the database can be found intheCyberPower PowerPanel application code, allowing the passwords to be recovered.

CVE-2024-34025

CyberPower PowerPanel business application code contains a hard-coded set of authenticationcredentials. This could result in an attacker bypassing authenticationand gaining administrator privileges.

CVE-2023-25133

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote fo...