CVE-2023-25133

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads	Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads	Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads	Product
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads	Product
https://zuso.ai/Advisory/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cyberpower:powerpanel:::::business:linux::
	cpe:2.3:a:cyberpower:powerpanel:::::business:macos::
	cpe:2.3:a:cyberpower:powerpanel:::::business:virtual_machine::
	cpe:2.3:a:cyberpower:powerpanel:::::business:windows::

History

No history.

Information

Published : 2023-04-24 11:15

Updated : 2023-05-02 20:24

NVD link : CVE-2023-25133

Mitre link : CVE-2023-25133

CVE.ORG link : CVE-2023-25133

JSON object : View

Products Affected

cyberpower

powerpanel

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2023-25133", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ART@zuso.ai", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2023-04-24T11:15:07.097", "references": [{"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads", "tags": ["Product"], "source": "ART@zuso.ai"}, {"url": "https://zuso.ai/Advisory/", "tags": ["Third Party Advisory"], "source": "ART@zuso.ai"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Secondary", "source": "ART@zuso.ai", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors."}], "lastModified": "2023-05-02T20:24:58.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:linux:*:*", "vulnerable": true, "matchCriteriaId": "231B7053-0BD9-4C08-8028-72F30768EF48", "versionEndIncluding": "4.8.6"}, {"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:macos:*:*", "vulnerable": true, "matchCriteriaId": "B38A1026-EED6-4606-B61A-F6FDCBF3BB4C", "versionEndIncluding": "4.8.6"}, {"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:virtual_machine:*:*", "vulnerable": true, "matchCriteriaId": "4DD5C6C4-2DBD-4C67-A10C-43A293ABD1A7", "versionEndIncluding": "4.8.6"}, {"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:windows:*:*", "vulnerable": true, "matchCriteriaId": "CA11A0E7-FAC1-4BF1-85D4-7370EAC1E0C2", "versionEndIncluding": "4.8.6"}], "operator": "OR"}]}], "sourceIdentifier": "ART@zuso.ai"}