CVE-2023-25131: critical vulnerability in CyberPower PowerPanel Business Management
Use of default password vulnerability in CyberPower PowerPanel Business
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
CyberPower PowerPanel Business comes with a default password for the admin account that is never required to be changed, allowing anyone who knows it to log in remotely and take full control of the system.
The application fails to enforce a password change on first login for the default 'admin' account across Windows, Linux, and macOS versions up to 4.8.6. Remote attackers can authenticate using the well-known default credentials to gain administrative access and execute arbitrary administrative functions without authentication bypass techniques.
In the same product, most dangerous first.