« Volver al listado

CVE-2024-32735

Estado: AnalizadaCrítica (9.8)—

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cyberpower — Powerpanel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32735",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32735",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-04T19:45:38.473682Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vulnreport@tenable.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vulnreport@tenable.com",
      "affectedData": [
        {
          "vendor": "CyberPower",
          "product": "CyberPower PowerPanel Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.8.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:cyberpower:powerpanel_enterprise:*:*:*:*:*:*:*:*"
          ],
          "vendor": "cyberpower",
          "product": "powerpanel_enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.8.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-14T15:37:03.527",
  "references": [
    {
      "url": "https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote",
      "tags": [
        "Release Notes"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2024-14",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2024-14",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application."
    },
    {
      "lang": "es",
      "value": "Existe un problema relacionado con la falta de autenticación para ciertas utilidades en CyberPower PowerPanel Enterprise antes de la versión 2.8.3. Un atacante remoto no autenticado puede acceder a las API REST de PDNU, lo que puede comprometer la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:30:20.363",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:enterprise:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "126B1CFF-D57B-4702-87D3-021C846308AD",
              "versionEndExcluding": "2.8.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnreport@tenable.com"
}