CVE-2023-3265 - An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials

Back Back to CVE browser

CRITICAL

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials

Published Aug 14, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.62%

Description

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials.

Affected products

Vendor CyberPower Product PowerPanel Enterprise Default
unaffected
- Version
  v2.6.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CyberPower

PowerPanel Enterprise

unaffected

Version	Status	Constraints
v2.6.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-150

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43941		Advisory
https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html		Vendor Advisory