CVE-2024-32053 CyberPower CVE debrief

Who should care

Organizations running CyberPower PowerPanel Business for UPS management and power infrastructure monitoring, particularly in industrial control system (ICS) environments where power continuity is critical to operations.

Technical summary

The PowerPanel Business platform uses hard-coded credentials for authentication to its database, auxiliary services, and cloud components. An attacker who extracts these credentials can authenticate as the PowerPanel Business application, gaining privileged access to backend systems. The vulnerability affects all deployments of PowerPanel Business 4.9.0 and earlier. The fix in version 4.10.1 replaces hard-coded credentials with properly configurable authentication mechanisms.

Defensive priority

critical

Recommended defensive actions

• Update PowerPanel Business to version 4.10.1 or later immediately
• Audit database, service, and cloud access logs for unauthorized activity using the hard-coded credentials
• Review and rotate any credentials that may have been derived from or similar to the hard-coded values
• Implement network segmentation to limit PowerPanel Business system exposure
• Apply defense-in-depth controls per CISA ICS recommended practices

Evidence notes

Hard-coded credentials are used by the platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel Business application.

Official resources