THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-31410

CyberPower PowerPanel business Use of Hard-coded Cryptographic Key

Reserved:2024-04-29
Published:2024-05-15
Updated:2024-05-15

Description

The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data.



HIGH: 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Problem types

CWE-321

Product status

Default status
unaffected

Any version before 4.9.0
affected

Credits

Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA. finder

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

cve.org CVE-2024-31410

nvd.nist.gov CVE-2024-31410

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-31410