CVE-2024-32042 MEDIUM

CVE-2024-32042: CyberPower PowerPanel business Storing Passwords in a Recoverable Format

Vendor Cyberpower

Product PowerPanel business

Weakness CWE-257

Published May 15, 2024

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

4.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered.

Key dates

02Disclosure timeline

May 15, 2024 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-32042 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/257.html

Related vulnerabilities

04Related CVE

CVE-2026-30785 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) CVE-2018-5446 Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format CVE-2016-15058 Hirschmann HiLCOS Classic Platform Password Exposure via SNMP CVE-2022-22251 cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges CVE-2019-19096 ABB eSOMS: REDIS clear text credentials