PT-2024-4518 · Cyberpower · Cyberpower Powerpanel Enterprise

Published 2024-05-09 · Updated 2024-07-03 · CVE-2024-32735

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise versions prior to 2.8.3

Description: The issue is related to missing authentication for certain utilities in CyberPower PowerPanel Enterprise, allowing an unauthenticated remote attacker to access the PDNU REST APIs. This may result in the compromise of the application. An attacker can exploit this issue to gain unauthorized access to the application through the REST API.

Recommendations: For versions prior to 2.8.3, update to version 2.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the PDNU REST APIs until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-05022

CVE-2024-32735

Affected Products

Cyberpower Powerpanel Enterprise

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-32735 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32735 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05022 · Security Note
• https://cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote · Note
• https://twitter.com/cracbot/status/1792072803627536648 · Twitter Post
• https://tenable.com/security/research/tra-2024-14 · Note
• https://cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote · Note
• https://twitter.com/cracbot/status/1791710418005873123 · Twitter Post