CVE-2024-33615
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel
server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| CyberPower | PowerPanel business | 0 < 4.9.0 | affected |
Weaknesses
- CWE-23: CWE-23
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
CVE Program Container
Additional References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01
- https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.