Skip to main content

Powerpanel CVE-2024-34025

CRITICAL
Use of Hard-coded Password (CWE-259)
2024-05-15 ics-cert@hq.dhs.gov
Authentication Bypass Powerpanel
9.8
CVSS 3.1 · Vendor: hq
Share

Severity by source

Vendor (hq) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 15, 2024 - 20:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentication and gaining administrator privileges.

AnalysisAI

CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-259. CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentication and gaining administrator privileges. Affected products include: Cyberpower Powerpanel.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Powerpanel

View all
CVE-2024-32735 CRITICAL POC
9.8 May 14

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8
CVE-2019-13071 HIGH POC
8.8 Jul 10

CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST req
CVE-2024-32739 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-32738 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-32737 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-32736 HIGH POC
7.5 May 14

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. Rated high severity (CVSS 7.5)
CVE-2024-33625 CRITICAL
9.8 May 15

CyberPower PowerPanel business application code contains a hard-coded JWT signing key. Rated critical severity (CVSS 9.8
CVE-2024-32053 CRITICAL
9.8 May 15

Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, a
CVE-2024-32047 CRITICAL
9.8 May 15

Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. Rated critical sev
CVE-2023-25133 CRITICAL
9.8 Apr 24

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 a
CVE-2023-25132 CRITICAL
9.8 Apr 24

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote fo
CVE-2023-25131 CRITICAL
9.8 Apr 24

Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Bus

Same weakness CWE-259 – Use of Hard-coded Password

View all
CVE-2025-57788 MEDIUM POC
6.9
CVE-2012-5862 CRITICAL POC
10.0
CVE-2024-42639 CRITICAL POC
9.8
CVE-2024-36526 CRITICAL POC
9.8
CVE-2024-38902 CRITICAL POC
9.8
CVE-2023-5222 CRITICAL POC
9.8
CVE-2023-3237 CRITICAL POC
9.8
CVE-2023-2645 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-34025 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy