CVE-2024-31856
Assigner: icscert
Published: 2024-05-15T19:52:37.407Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: PowerPanel business
vendor: CyberPower
versions: lessThan: 4.9.0
status: affected
version: 0
versionType: custom
credits: type: finder
value: Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: <div>

An attacker with certain MQTT permissions can create malicious messages 
to all CyberPower PowerPanel devices. This could result in an attacker injecting 
SQL syntax, writing arbitrary files to the system, and executing remote 
code.

<br></div>
value: An attacker with certain MQTT permissions can create malicious messages 
to all CyberPower PowerPanel devices. This could result in an attacker injecting 
SQL syntax, writing arbitrary files to the system, and executing remote 
code.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 
<p>CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.</p>
<p><a target="_blank" rel="nofollow" href="https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads">https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads</a><br></p>

<br>
value: CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.


 https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
source: advisory: ICSA-24-123-01
discovery: EXTERNAL
title: CyberPower PowerPanel business SQL Injection
x_generator: engine: Vulnogram 0.2.0