Vulnerability · Published May 15, 2024 · Assigned by icscert
CVE-2024-31410CyberPower PowerPanel business Use of Hard-coded Cryptographic Key
High 7.7
In plain English
A high-severity security flaw in PowerPanel business from CyberPower. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CyberPower | PowerPanel business | 0 – before 4.9.0 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N