CyberPower PowerPanel Business Local/Remote/Management v4.8.6 and earlier (Windows and Linux): A default password

Impact

A default password that ships enabled. This is the most boring vulnerability in the facility layer and probably the most exploited class of them in practice - power management software gets installed once by whoever racked the gear and never revisited.

Who can reach it

Unauthenticated remote access to the PowerPanel Business interface using published default credentials.

What to do

Upgrade past v4.8.6 and change the credential. Then go and check every other piece of power-management software you inherited with a build: default credentials on facility gear are the single highest-yield internal audit an operator can run, and it costs a day.

References

Related entries

• Grafana: Azure AD accounts validated on the mutable, non-unique email claimCVE-2023-3128 · GrafanaCritical
• Citrix NetScaler ADC/Gateway: "CitrixBleed" - memory overread leaking valid session tokensCVE-2023-4966 · Citrix NetScaler ADC/GatewayCritical
• Nagios XI: Docker Wizard command injection gives admins code execution as the web userCVE-2024-14005 · Nagios XI Docker Wizard (shell metacharacter injection)Critical
• GitLab: an unauthenticated GraphQL directive can modify or delete public projects and user dataCVE-2026-19478 · GitLab CE/EE (GraphQL API directive handling)Critical
• CloudNativePG: a database owner escalates to PostgreSQL superuser and OS command execution in the podCVE-2026-55769 · CloudNativePG instance manager (unpinned search_path on superuser connections)Critical
• CloudNativePG instance manager (PostgreSQL connection search_path): The owner of any managed database — a roleNCVD-2026-048-cloudnativepg-instance-manager-p · CloudNativePG instance manager (PostgreSQL connection search_path)Critical