PT-2023-23939 · Cyberpower · Cyberpower Powerpanel Enterprise

Philippe Laulheret · Published 2023-08-13 · Updated 2023-08-22 · CVE-2023-3266

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Enterprise (affected versions not specified)

Description A non-feature complete authentication mechanism exists in the production application, allowing an attacker to bypass all authentication checks if LDAP authentication is selected. An unauthenticated attacker can leverage this issue to log in to the CyberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation also requires the attacker to know at least one username on the device, but any password will authenticate successfully.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2023-3266

Affected Products

Cyberpower Powerpanel Enterprise

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3266 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3266 · Vendor Advisory
• https://trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html · Vendor Advisory
• https://t.me/cibsecurity/68423 · Telegram Post
• https://twitter.com/CVEnew/status/1690945904071614465 · Twitter Post
• https://t.me/cvenotify/56389 · Telegram Post
• https://twitter.com/cracbot/status/1691328927846076416 · Twitter Post