Powerpanel Server
Vendor:
First CVE: Aug 14, 2023 · Active for 2 years
6
Total CVEs
More Total CVEs than 83% of tracked products
6.0
Avg CVEs / Year
Higher CVE frequency than 91% of tracked products
9.0
Avg CVSS
Higher Avg CVSS than 84% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Powerpanel Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 14, 2023
2 years ago
Most Recent CVE
Aug 14, 2023
1,079 days ago
CVE Severity & Scoring
Powerpanel Server6 CVEs
50%
50%
All CVEs353,173 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network6 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low2 (33.3%)
High1 (16.7%)
None3 (50.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-3266CRITICAL A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An | Aug 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2023-3265CRITICAL An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application wit | Aug 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2023-3264CRITICAL The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent wi | Aug 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2023-3267HIGH When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running | Aug 14, 2023 | 8.8 | 29 | NO | NO |
CVE-2023-3260HIGH The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can | Aug 14, 2023 | 8.8 | 22 | NO | NO |
CVE-2023-3261HIGH The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful exploitation could caus | Aug 14, 2023 | 7.2 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Powerpanel Server
Top CWEs
Versions
No cataloged versions.