CVE-2024-32053

In CyberPower PowerPanel software, authentication credentials (username and password) are permanently embedded in the application code or configuration (CWE-798 — Use of Hard-coded Credentials). This means that each product installation has identical, unchangeable access credentials to the database, internal services, and cloud infrastructure. An attacker who obtains these credentials (e.g., through analysis of binary or configuration files) can use them to directly authenticate to any instance of the product, without needing their own privileges.

A remote attacker without authentication can gain full access (read, write, delete data) to the database, associated services, and cloud resources with PowerPanel Business application privileges, which may lead to breach of confidentiality, integrity, and system availability.

Apply patches available from the vendor according to references — update available on the CyberPower website for PowerPanel Business for Windows product. Details regarding the patched version are contained in CISA ICS Advisory ICSA-24-123-01.

CyberPower PowerPanel Business (versions indicated in vendor references and CISA ICS-CERT advisory ICSA-24-123-01)