CVE-2023-3267 Command injection in PowerPanel Enterprise
Authenticated attackers can execute arbitrary system commands via the username field when adding a remote backup location in CyberPower PowerPanel Enterprise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3267?
CVE-2023-3267 is a critical command injection vulnerability in CyberPower PowerPanel Enterprise, published on 14 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with system-level access to the CyberPower PowerPanel Enterprise server.
Weakness: CWE-78
Which versions are affected by CVE-2023-3267?
It affects 1 product.
Products include Cyberpower Powerpanel Server.
How do I fix CVE-2023-3267?
No fix has been published for CVE-2023-3267 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-3267 being exploited?
There is no known exploitation of CVE-2023-3267 in the wild and no public exploit code.
Other vulnerabilities in CyberPower PowerPanel Enterprise
Sources
Also known as GHSA-hpm4-5h9r-6rg6.