Vulnerability Description
Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cyberpower | Powerpanel | <= 4.8.6 |
Related Weaknesses (CWE)
References
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#dProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#dowProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtualProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windowsProduct
- https://zuso.ai/Advisory/Third Party Advisory
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#dProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#dowProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtualProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windowsProduct
- https://zuso.ai/Advisory/Third Party Advisory
FAQ
What is CVE-2023-25131?
CVE-2023-25131 is a vulnerability with a CVSS score of 9.4 (CRITICAL). Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remot...
How severe is CVE-2023-25131?
CVE-2023-25131 has been rated CRITICAL with a CVSS base score of 9.4/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-25131?
Check the references section above for vendor advisories and patch information. Affected products include: Cyberpower Powerpanel.