« Volver al listado

CVE-2024-32053

Estado: AnalizadaCrítica (9.8)—

Hard-coded credentials are used by the  CyberPower PowerPanel

platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel business application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cyberpower — Powerpanel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32053",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32053",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-16T15:58:18.805976Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "CyberPower",
          "product": "PowerPanel business",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.9.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:cyberpower:powerpanel_business:*:*:*:*:*:*:*:*"
          ],
          "vendor": "cyberpower",
          "product": "powerpanel_business",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.9.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-15T20:15:12.443",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads",
      "tags": [
        "Product"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hard-coded credentials are used by the \nCyberPower PowerPanel \n\n platform to authenticate to the \ndatabase, other services, and the cloud. This could result in an \nattacker gaining access to services with the privileges of a Powerpanel \nbusiness application."
    },
    {
      "lang": "es",
      "value": "La plataforma CyberPower PowerPanel utiliza credenciales codificadas para autenticarse en la base de datos, otros servicios y la nube. Esto podría resultar en que un atacante obtenga acceso a servicios con los privilegios de una aplicación empresarial Powerpanel."
    }
  ],
  "lastModified": "2026-06-17T07:29:11.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63016483-EF5A-42FE-BBC2-D7E66C24B9B1",
              "versionEndIncluding": "4.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}