{"id":"CVE-2024-32053","state":"PUBLISHED","title":"CyberPower PowerPanel business Use of Hard-coded Credentials","description":"Hard-coded credentials are used by the \nCyberPower PowerPanel \n\n platform to authenticate to the \ndatabase, other services, and the cloud. This could result in an \nattacker gaining access to services with the privileges of a Powerpanel \nbusiness application.","publishedAt":"2024-05-15T19:34:30.153Z","updatedAt":"2024-08-02T02:06:43.251Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["CyberPower PowerPanel business"],"affected":[{"vendor":"CyberPower","product":"PowerPanel business","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.9.0","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01","https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/32xxx/CVE-2024-32053.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-32053","state":"PUBLISHED","datePublished":"2024-05-15T19:34:30.153Z","dateUpdated":"2024-08-02T02:06:43.251Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-04-29T16:47:22.358Z"},"containers":{"cna":{"title":"CyberPower PowerPanel business Use of Hard-coded Credentials","descriptions":[{"lang":"en","value":"Hard-coded credentials are used by the \nCyberPower PowerPanel \n\n platform to authenticate to the \ndatabase, other services, and the cloud. This could result in an \nattacker gaining access to services with the privileges of a Powerpanel \nbusiness application."}],"affected":[{"vendor":"CyberPower","product":"PowerPanel business","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.9.0","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01"},{"url":"https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-05-15T19:34:30.153Z"},"credits":[{"lang":"en","type":"finder","value":"Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n<p>CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.</p>\n<p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads\">https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads</a><br></p>\n\n<br>"}],"value":"CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.\n\n\n https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}],"source":{"advisory":"ICSA-24-123-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"cyberpower","product":"powerpanel_business","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.9.0","versionType":"custom"}],"cpes":["cpe:2.3:a:cyberpower:powerpanel_business:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-32053","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-05-16T15:58:18.805976Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:51:38.726Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01","tags":["x_transferred"]},{"url":"https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T02:06:43.251Z"}}]}}}