CVE-2024-11322 CyberPower PowerPanel Business Unauthenticated Restart DoS
Unauthenticated remote attackers can repeatedly restart the PowerPanel Business service, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11322?
CVE-2024-11322 is a high-severity denial of service vulnerability in C4.yberPower PowerPanel Business, published on 15 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the ppbd.exe process via the PowerPanel Business Service Watchdog service listening on TCP port 2003. The attacker can repeatedly restart ppbd.exe to render it unavailable.
Weakness: CWE-287
Which versions are affected by CVE-2024-11322?
How do I fix CVE-2024-11322?
No fix has been published for CVE-2024-11322 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-11322 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11322 exists.
Sources
Also known as GHSA-4m24-77gc-h7mm.