CVE-2024-32042 - Vulnerability Details - OpenCVE

The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cyberpower	Powerpanel Powerpanel Business

Configuration 1 [-]

cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:windows:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01
https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

History

Wed, 30 Jul 2025 00:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cyberpower powerpanel
CPEs		cpe:2.3:a:cyberpower:powerpanel:::::business:windows::
Vendors & Products		Cyberpower powerpanel

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-05-15T19:39:08.086Z

Updated: 2024-08-02T02:06:43.266Z

Reserved: 2024-04-29T16:47:22.354Z

Link: CVE-2024-32042

Vulnrichment

Updated: 2024-08-02T02:06:43.266Z

NVD

Status : Analyzed

Published: 2024-05-15T20:15:11.950

Modified: 2025-07-30T00:19:33.853

Link: CVE-2024-32042

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32042", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-04-29T16:47:22.354Z", "datePublished": "2024-05-15T19:39:08.086Z", "dateUpdated": "2024-08-02T02:06:43.266Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PowerPanel business", "vendor": "CyberPower", "versions": [{"lessThan": "4.9.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>\nThe key used to encrypt passwords stored in the database can be found in\n the \nCyberPower PowerPanel\n\napplication code, allowing the passwords to be recovered.\n\n<br></div>"}], "value": "The key used to encrypt passwords stored in the database can be found in\n the \nCyberPower PowerPanel\n\napplication code, allowing the passwords to be recovered."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-257", "description": "CWE-257", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-05-15T19:39:08.086Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n<p>CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.</p>\n<p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads\">https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads</a><br></p>\n\n<br>"}], "value": "CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.\n\n\n https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}], "source": {"advisory": "ICSA-24-123-01", "discovery": "EXTERNAL"}, "title": "CyberPower PowerPanel business Storing Passwords in a Recoverable Format", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-24T18:50:17.986724Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cyberpower:powerpanel_business:*:*:*:*:*:*:*:*"], "vendor": "cyberpower", "product": "powerpanel_business", "versions": [{"status": "affected", "version": "0", "lessThan": "4.9.0", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:51:52.502Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:06:43.266Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01", "tags": ["x_transferred"]}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01", "tags": ["x_transferred"]}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:06:43.266Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-24T18:50:17.986724Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cyberpower:powerpanel_business:*:*:*:*:*:*:*:*"], "vendor": "cyberpower", "product": "powerpanel_business", "versions": [{"status": "affected", "version": "0", "lessThan": "4.9.0", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-24T18:50:47.977Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "CyberPower PowerPanel business Storing Passwords in a Recoverable Format", "source": {"advisory": "ICSA-24-123-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Amir Preminger and Noam Moshe of Claroty Team82 Research reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CyberPower", "product": "PowerPanel business", "versions": [{"status": "affected", "version": "0", "lessThan": "4.9.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.\n\n\n https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads", "supportingMedia": [{"type": "text/html", "value": "\n<p>CyberPower has released a new version (v4.10.1 or later version) of PowerPanel business that fixes these vulnerabilities.</p>\n<p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads\">https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads</a><br></p>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01"}, {"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The key used to encrypt passwords stored in the database can be found in\n the \nCyberPower PowerPanel\n\napplication code, allowing the passwords to be recovered.", "supportingMedia": [{"type": "text/html", "value": "<div>\nThe key used to encrypt passwords stored in the database can be found in\n the \nCyberPower PowerPanel\n\napplication code, allowing the passwords to be recovered.\n\n<br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-257", "description": "CWE-257"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-05-15T19:39:08.086Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32042", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:06:43.266Z", "dateReserved": "2024-04-29T16:47:22.354Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-05-15T19:39:08.086Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:business:windows:*:*", "matchCriteriaId": "63016483-EF5A-42FE-BBC2-D7E66C24B9B1", "versionEndIncluding": "4.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The key used to encrypt passwords stored in the database can be found in\n the \nCyberPower PowerPanel\n\napplication code, allowing the passwords to be recovered."}, {"lang": "es", "value": "La clave utilizada para cifrar las contrase\u00f1as almacenadas en la base de datos se puede encontrar en el c\u00f3digo de la aplicaci\u00f3n CyberPower PowerPanel, lo que permite recuperar las contrase\u00f1as."}], "id": "CVE-2024-32042", "lastModified": "2025-07-30T00:19:33.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-05-15T20:15:11.950", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01"}, {"source": "[email protected]", "tags": ["Product"], "url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-257"}], "source": "[email protected]", "type": "Secondary"}]}