CVE-2023-25132
Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- cyberpower/powerpanel
- Source
- ART@zuso.ai
References
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloadsProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloadsProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloadsProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloadsProduct
- https://zuso.ai/Advisory/Third Party Advisory
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloadsProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloadsProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloadsProduct
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloadsProduct
- https://zuso.ai/Advisory/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.