CVE-2023-3266 Auth bypass in PowerPanel Enterprise

Critical 9.8 Published 14 Aug 2023 Updated 9 Oct 2024

An attacker can bypass authentication and gain administrator access by selecting LDAP in a hidden menu, provided they know a valid username.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-3266?

CVE-2023-3266 is a critical authentication bypass vulnerability in CyberPower PowerPanel Enterprise, published on 14 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also requires the attacker to know at least one username on the device, but any password will authenticate successfully.

Weakness: CWE-358

Which versions are affected by CVE-2023-3266?

It affects 1 product.

Products include Cyberpower Powerpanel Server.

How do I fix CVE-2023-3266?

No fix has been published for CVE-2023-3266 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-3266 being exploited?

There is no known exploitation of CVE-2023-3266 in the wild and no public exploit code.

Sources

Also known as GHSA-928v-hp47-95m3.