Skip to main content

Powerpanel CVE-2023-25131

CRITICAL
Use of Default Password (CWE-1393)
2023-04-24 ART@zuso.ai
Information Disclosure Apple Microsoft Powerpanel
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 24, 2023 - 10:15 nvd
CRITICAL 9.8

DescriptionNVD

Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password.

AnalysisAI

Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1393. Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password. Affected products include: Cyberpower Powerpanel.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Powerpanel

View all
CVE-2024-32735 CRITICAL POC
9.8 May 14

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8
CVE-2019-13071 HIGH POC
8.8 Jul 10

CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST req
CVE-2024-32739 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-32738 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-32737 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-32736 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-34025 CRITICAL
9.8 May 15

CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. Rated critical

CVE-2024-33625 CRITICAL
9.8 May 15

CyberPower PowerPanel business application code contains a hard-coded JWT signing key. Rated critical severity (CVSS 9.8
CVE-2024-32053 CRITICAL
9.8 May 15

Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, a
CVE-2024-32047 CRITICAL
9.8 May 15

Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. Rated critical sev
CVE-2023-25133 CRITICAL
9.8 Apr 24

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 a
CVE-2023-25132 CRITICAL
9.8 Apr 24

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote fo

Same weakness CWE-1393 – Use of Default Password

View all
CVE-2025-26793 CRITICAL POC
9.3
CVE-2025-22938 CRITICAL POC
9.8
CVE-2024-48987 MEDIUM POC
6.6
CVE-2025-26701 CRITICAL
10.0
CVE-2025-27690 CRITICAL
9.8
CVE-2026-5269 CRITICAL
9.8
CVE-2026-24429 CRITICAL
9.8
CVE-2025-66050 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-25131 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy