CVE-2024-32735 CyberPower PowerPanel Enterprise Missing Authentication
Unauthenticated attackers can access PDNU REST APIs in CyberPower PowerPanel Enterprise, potentially compromising the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-32735?
CVE-2024-32735 is a critical missing authorization vulnerability in CyberPower PowerPanel Enterprise, published on 9 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.
Weakness: CWE-306
Which versions are affected by CVE-2024-32735?
It affects 1 product.
Products include Cyberpower Powerpanel.
How do I fix CVE-2024-32735?
No fix has been published for CVE-2024-32735 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-32735 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32735 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in CyberPower PowerPanel Enterprise
- CVE-2024-32047 CyberPower PowerPanel business Active Debug Code
- CVE-2024-32053 CyberPower PowerPanel business Use of Hard-coded Credentials
- CVE-2024-33625 CyberPower PowerPanel business Use of Hard-coded Password
- CVE-2024-34025 CyberPower PowerPanel business Use of Hard-coded Password
- CVE-2023-25131 Use of default password vulnerability in CyberPower PowerPanel Business
Sources
Also known as GHSA-67p4-w92f-qx68.