Critical severity · published May 9, 2024
CVE-2024-32735
CyberPower PowerPanel Enterprise Missing Authentication
9.8
CVSS
6.8%
EPSS
No
On KEV
Description
An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.8% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CyberPower PowerPanel Enterprise · CyberPower
before 2.8.3 · source: vendor
PO
Powerpanel · Cyberpower
before 2.8.3 · source: NVD
PE
Powerpanel Enterprise · Cyberpower
before 2.8.3 · source: CISA
Affected product
CP
CyberPower PowerPanel Enterprise
CyberPower
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32735
Release Notes
https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
Third Party Advisory
https://www.tenable.com/security/research/tra-2024-14
More from CyberPower PowerPanel Enterprise
7.5
CVE-2024-32739
CyberPower PowerPanel Enterprise SQL Injection
7.5
CVE-2024-32738
CyberPower PowerPanel Enterprise SQL Injection
7.5
CVE-2024-32737
CyberPower PowerPanel Enterprise SQL Injection
7.5
CVE-2024-32736
CyberPower PowerPanel Enterprise SQL Injection