CVE-2024-32047

The vulnerability (CWE-489) consists of code intended exclusively for the test environment — containing statically embedded credentials — being included in the production version of the software. An attacker who discovers these credentials (e.g., through binary or source code analysis) can use them to authenticate to the server without knowing the proper passwords. Since these credentials are identical across all installations, the attack can be carried out by anyone with access to the application files.

An attacker can gain unauthorized access to a test or production server managing UPS power supply, potentially leading to compromise of confidentiality, integrity, and availability of the system.

Apply patches available from the vendor according to the references. Detailed information about patched versions is available in the CISA ICS Advisory ICSA-24-123-01 and on the CyberPower PowerPanel Business for Windows download page.

CyberPower PowerPanel — versions indicated in the vendor references (ICS Advisory ICSA-24-123-01)