Critical severity · published Apr 24, 2023
CVE-2023-25131
Use of default password vulnerability in CyberPower PowerPanel Business
9.8
CVSS
1%
EPSS
No
On KEV
Description
Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
PowerPanel Business Local / Remote · CyberPower
through v4.8.6 · source: vendor
PB
PowerPanel Business Management · CyberPower
through v4.8.6 · source: vendor
PO
Powerpanel · Cyberpower
through 4.8.6; through 4.8.6; through 4.8.6; through 4.8.6 · source: NVD
Affected product
PB
PowerPanel Business Local / Remote
CyberPower
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25131
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25131
Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads
Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads
Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads
Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
Third Party Advisory
https://zuso.ai/Advisory/
More from PowerPanel Business Local / Remote
9.8
CVE-2023-25132
Unrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel Business
9.8
CVE-2023-25133
Improper privilege management vulnerability in CyberPower PowerPanel Business