PT-2023-23931 · Cyberpower · Cyberpower Powerpanel Enterprise

Philippe Laulheret · Published 2023-08-13 · Updated 2023-08-22 · CVE-2023-3265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Enterprise (affected versions not specified)

Description An authentication bypass exists in CyberPower PowerPanel Enterprise due to the failure to sanitize meta-characters from the username, allowing an attacker to log in to the application with the default user "cyberpower" by appending a non-printable character. An unauthenticated attacker can leverage this issue to log in to the CyberPower PowerPanel Enterprise as an administrator with hardcoded default credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2023-3265

Affected Products

Cyberpower Powerpanel Enterprise

References · 8

• https://osv.dev/vulnerability/CVE-2023-3265 · Vendor Advisory
• https://trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3265 · Security Note
• https://twitter.com/fletch_ai/status/1691300433443123200 · Twitter Post
• https://t.me/cibsecurity/68426 · Telegram Post
• https://t.me/cvenotify/56390 · Telegram Post
• https://twitter.com/cracbot/status/1691328926164123649 · Twitter Post
• https://twitter.com/CVEnew/status/1690945903018872832 · Twitter Post