Database/Control plane, storage & DevOps
CyberPower PowerPanel platform - hardcoded database, service and cloud credentials: Hardcoded credentials used
Impact
Hardcoded credentials used by the platform to authenticate to its database, to other services and to CyberPower's cloud. The cloud element is what makes this worth calling out separately: the credential is shared across deployments, so an attacker who extracts it once has a position against many operators' installations at the vendor's back end, not just yours.
Who can reach it
Anyone with the shipped software. The cloud credential in particular is reachable from the internet by design.
What to do
Vendor upgrade is the only fix. Ask the vendor directly whether the cloud-side credential was rotated on their end - your upgrade does not do that. If the answer is unsatisfying, disable the cloud integration.
References
Related entries
- CyberPower PowerPanel Enterprise prior to v2.8.3 - PDNU REST APIs: Certain utility REST APIs have no authenticationCVE-2024-32735 · CyberPower PowerPanel Enterprise prior to v2.8.3 - PDNU REST APIsCritical
- CyberPower PowerPanel business application - JWT signing key: The JWT signing key is hardcoded in the application, soCVE-2024-33625 · CyberPower PowerPanel business application - JWT signing keyCritical
- CyberPower PowerPanel business application - hardcoded authentication credentials: A hardcoded credential set compiledCVE-2024-34025 · CyberPower PowerPanel business application - hardcoded authentication credentialsCritical
- Volcano (v1.8.2 and earlier, service account token permissions): Volcano 1.8.2 ships over-permissive settings that letCVE-2024-36533 · Volcano (v1.8.2 and earlier, service account token permissions)Critical
- VMware vCenter Server (DCERPC heap overflow): A heap overflow in the DCERPC implementation lets an unauthenticatedCVE-2024-37080 · VMware vCenter Server (DCERPC heap overflow)Critical
- Terraform (go-getter): Argument injection when go-getter shells out to Git for remote branch discoveryCVE-2024-3817 · Terraform (go-getter)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.