PatchSiren cyber security CVE debrief

CVE-2024-32047 CyberPower CVE debrief

CyberPower PowerPanel Business versions 4.9.0 and earlier contain hard-coded credentials for a test server embedded in production code. This vulnerability, published by CISA on May 2, 2024, carries a CVSS 3.0 score of 9.8 (Critical) due to network-accessible attack vectors requiring no authentication, with potential for complete confidentiality, integrity, and availability compromise. The hard-coded credentials could allow attackers to gain unauthorized access to testing or production environments. CyberPower has released version 4.10.1 to address this issue. Organizations should prioritize patching given the critical severity and low attack complexity.

Vendor: CyberPower
Product: PowerPanel Business
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-05-02
Original CVE updated: 2025-08-07
Advisory published: 2024-05-02
Advisory updated: 2025-08-07

Who should care

Organizations running CyberPower PowerPanel Business for UPS management, particularly in industrial control system (ICS) environments where availability is critical. Security teams responsible for OT/ICS asset management and vulnerability remediation should prioritize this patch due to the critical CVSS score and unauthenticated exploitation path.

Technical summary

CVE-2024-32047 affects CyberPower PowerPanel Business ≤4.9.0, where hard-coded credentials for a test server were discovered in production code. The vulnerability enables unauthenticated network attackers to potentially access testing or production servers. CISA assigned CVSS 3.0 9.8 (Critical) based on network attack vector, low complexity, no privileges required, and high impact across confidentiality, integrity, and availability. CyberPower remediated this in version 4.10.1. The issue represents a common secure development lifecycle failure where test artifacts are not removed before production release.

Defensive priority

critical

Recommended defensive actions

Update CyberPower PowerPanel Business to version 4.10.1 or later immediately
Audit access logs for unauthorized connections to PowerPanel Business servers using test server credentials
Review network segmentation to ensure PowerPanel Business systems are not exposed to untrusted networks
Implement credential rotation procedures for any accounts that may have used default or hard-coded credentials
Conduct vulnerability scans to identify remaining instances of PowerPanel Business ≤4.9.0 in the environment

Evidence notes

CISA ICS advisory ICSA-24-123-01 confirms hard-coded credentials in PowerPanel Business ≤4.9.0. CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H supports network-exploitable, unauthenticated attack scenario. Vendor fix confirmed with specific patch version 4.10.1.

Official resources

2024-05-02