CVE-2023-3265 CRITICAL

CVE-2023-3265

Vendor Cyberpower
Product PowerPanel Enterprise
Weakness CWE-150
Published August 14, 2023
Last update October 9, 2024

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials.

Key dates

02Disclosure timeline

August 14, 2023 CVE published
October 9, 2024 Record updated