Read the docs

CyberPower

Records23All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical12CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

CyberPower records in CISA KEV

No CyberPower vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Powerpanel 16 records HIGH Powerpanel Server 6 records MEDIUM

Records

16 records in Powerpanel · all components

TI-2024-21614 CVE-2024-32735 · GHSA-67p4-w92f-qx68

CyberPower PowerPanel Enterprise Missing Authentication

Priority HIGH 82

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06765 Published 2024-05-09 Fixed in 2.8.3 CWE-306
TI-2024-21618 CVE-2024-32739 · GHSA-v2jj-6wcp-962x

CyberPower PowerPanel Enterprise SQL Injection

Priority HIGH 72

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05408 Published 2024-05-09 Fixed in 2.8.3 CWE-89
TI-2024-21616 CVE-2024-32737 · GHSA-76hv-682v-6fpm

CyberPower PowerPanel Enterprise SQL Injection

Priority HIGH 72

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05408 Published 2024-05-09 Fixed in 2.8.3 CWE-89
TI-2024-21615 CVE-2024-32736 · GHSA-262h-qq26-j72g

CyberPower PowerPanel Enterprise SQL Injection

Priority HIGH 72

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05408 Published 2024-05-09 Fixed in 2.8.3 CWE-89
TI-2024-22494 CVE-2024-34025 · GHSA-w664-f83j-wrqm

CyberPower PowerPanel business Use of Hard-coded Password

Priority MEDIUM 50

CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2024-05-15 Fixed in 4.9.0 CWE-259
TI-2023-10596 CVE-2023-25131 · GHSA-rx95-f4h8-xf6w

Use of default password vulnerability in CyberPower PowerPanel Business

Priority MEDIUM 50

Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00968 Published 2023-04-24 No fix listed CWE-1393
TI-2024-21141 CVE-2024-32053 · GHSA-3m49-xc8r-9rm5

CyberPower PowerPanel business Use of Hard-coded Credentials

Priority MEDIUM 49

Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00474 Published 2024-05-15 Fixed in 4.9.0 CWE-798
TI-2024-21137 CVE-2024-32047 · GHSA-26gh-5qf3-p3q4

CyberPower PowerPanel business Active Debug Code

Priority MEDIUM 49

Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00513 Published 2024-05-15 Fixed in 4.9.0 CWE-489
TI-2024-21617 CVE-2024-32738 · GHSA-v2hv-5634-vcq8

CyberPower PowerPanel Enterprise SQL Injection

Priority MEDIUM 46

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04553 Published 2024-05-09 Fixed in 2.8.3 CWE-89
TI-2023-10598 CVE-2023-25133 · GHSA-vjxg-x937-gmrq

Improper privilege management vulnerability in CyberPower PowerPanel Business

Priority MEDIUM 45

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01034 Published 2023-04-24 No fix listed CWE-269
TI-2023-10597 CVE-2023-25132 · GHSA-f845-2vfr-jp74

Unrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel Business

Priority MEDIUM 45

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01118 Published 2023-04-24 No fix listed CWE-434
TI-2024-20975 CVE-2024-31856 · GHSA-qfq2-j4x8-f29x

CyberPower PowerPanel business SQL Injection

Priority MEDIUM 41

An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00533 Published 2024-05-15 Fixed in 4.9.0 CWE-89
TI-2024-20780 CVE-2024-31409 · GHSA-cjwm-89qw-9q6v

CyberPower PowerPanel business Incorrect Authorization

Priority LOW 35

Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00354 Published 2024-05-15 Fixed in 4.9.0 CWE-863
Open these records in search →