PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-32047 CyberPower CVE debrief

CyberPower PowerPanel Business versions 4.9.0 and earlier contain hard-coded credentials for a test server embedded in production code. This vulnerability, published by CISA on May 2, 2024, carries a CVSS 3.0 score of 9.8 (Critical) due to network-accessible attack vectors requiring no authentication, with potential for complete confidentiality, integrity, and availability compromise. The hard-coded credentials could allow attackers to gain unauthorized access to testing or production environments. CyberPower has released version 4.10.1 to address this issue. Organizations should prioritize patching given the critical severity and low attack complexity.

Vendor
CyberPower
Product
PowerPanel Business
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-02
Original CVE updated
2025-08-07
Advisory published
2024-05-02
Advisory updated
2025-08-07

Who should care

Organizations running CyberPower PowerPanel Business for UPS management, particularly in industrial control system (ICS) environments where availability is critical. Security teams responsible for OT/ICS asset management and vulnerability remediation should prioritize this patch due to the critical CVSS score and unauthenticated exploitation path.

Technical summary

CVE-2024-32047 affects CyberPower PowerPanel Business ≤4.9.0, where hard-coded credentials for a test server were discovered in production code. The vulnerability enables unauthenticated network attackers to potentially access testing or production servers. CISA assigned CVSS 3.0 9.8 (Critical) based on network attack vector, low complexity, no privileges required, and high impact across confidentiality, integrity, and availability. CyberPower remediated this in version 4.10.1. The issue represents a common secure development lifecycle failure where test artifacts are not removed before production release.

Defensive priority

critical

Recommended defensive actions

  • Update CyberPower PowerPanel Business to version 4.10.1 or later immediately
  • Audit access logs for unauthorized connections to PowerPanel Business servers using test server credentials
  • Review network segmentation to ensure PowerPanel Business systems are not exposed to untrusted networks
  • Implement credential rotation procedures for any accounts that may have used default or hard-coded credentials
  • Conduct vulnerability scans to identify remaining instances of PowerPanel Business ≤4.9.0 in the environment

Evidence notes

CISA ICS advisory ICSA-24-123-01 confirms hard-coded credentials in PowerPanel Business ≤4.9.0. CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H supports network-exploitable, unauthenticated attack scenario. Vendor fix confirmed with specific patch version 4.10.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-32047 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-32047

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-32047 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-32047

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-123-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.