No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Amir Preminger, Noam Moshe (Claroty Team82 Research)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-32047 | CWE-489 Active Debug Code | 9.8 Critical |
Hard-coded credentials for the test server can be found in the production code. This might result in an attacker gaining access to the testing or production server. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-32053 | CWE-798 Use of Hard-coded Credentials | 9.8 Critical |
Hard-coded credentials are used by the platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel Business application. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-33625 | CWE-259 Use of Hard-coded Password | 9.8 Critical |
The application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authentication. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-34025 | CWE-259 Use of Hard-coded Password | 9.8 Critical |
The application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentication and gaining administrator privileges. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-31856 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8.8 High |
An attacker with certain MQTT permissions can create malicious messages to all Power Panel devices. This could result in an attacker injecting SQL syntax, writing arbitrary files to the system, and executing remote code. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-33615 | CWE-23 Relative Path Traversal | 8.8 High |
A specially crafted Zip file containing path traversal characters can be imported to the server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-31409 | CWE-863 Incorrect Authorization | 6.5 Medium |
Certain MQTT wildcards are not blocked on the system, which might result in an attacker obtaining data from throughout the system after gaining access to any device. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-31410 | CWE-321 Use of Hard-coded Cryptographic Key | 6.5 Medium |
The devices Power Panel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-32042 | CWE-257 Storing Passwords in a Recoverable Format | 4.9 Medium |
The key used to encrypt passwords stored in the database can be found in the application code, allowing the passwords to be recovered. Vendor fix: CyberPower has released a new version of PowerPanel Business that fixes these vulnerabilities: Vendor fix: PowerPanel Business: Update to v4.10.1 or later version ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-32047 | 9.8 Critical | CyberPower PowerPanel business Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining acce… |
| CVE-2024-32053 | 9.8 Critical | CyberPower PowerPanel business Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could… |
| CVE-2024-33625 | 9.8 Critical | CyberPower PowerPanel business CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypas… |
| CVE-2024-34025 | 9.8 Critical | CyberPower PowerPanel business CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing … |
| CVE-2024-31856 | 8.8 High | CyberPower PowerPanel business An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attacker injec… |
| CVE-2024-33615 | 8.8 High | CyberPower PowerPanel business A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing … |
| CVE-2024-31410 | 7.7 High | CyberPower PowerPanel business The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to im… |
| CVE-2024-31409 | 6.5 Medium | CyberPower PowerPanel business Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the sy… |
| CVE-2024-32042 | 4.9 Medium | CyberPower PowerPanel business The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be … |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.