CVE-2024-32735
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to access PDNU REST APIs in CyberPower PowerPanel Enterprise, potentially leading to application compromise. It affects versions prior to 2.8.3, exposing systems to unauthorized control and data manipulation.
💻 Affected Systems
- CyberPower PowerPanel Enterprise
📦 What is this software?
Powerpanel by Cyberpower
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the PowerPanel Enterprise application, allowing attackers to manipulate power management settings, disrupt operations, or pivot to other systems.
Likely Case
Unauthorized access to sensitive power management data and configuration, potentially enabling further attacks or operational interference.
If Mitigated
Limited impact if network segmentation and access controls restrict exposure, but risk remains if unpatched.
🎯 Exploit Status
Exploitation is straightforward due to missing authentication, but no public proof-of-concept has been confirmed as of the provided references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.3
Vendor Advisory: https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
Restart Required: Yes
Instructions:
1. Download the update from the CyberPower vendor advisory. 2. Backup current configuration. 3. Install version 2.8.3 or later. 4. Restart the PowerPanel Enterprise service to apply changes.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the PowerPanel Enterprise APIs using firewalls or network segmentation to limit exposure to trusted IPs only.
iptables -A INPUT -p tcp --dport <API_PORT> -s <TRUSTED_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport <API_PORT> -j DROP
Disable Unused APIs
allIf PDNU REST APIs are not required, disable them in the application configuration to reduce attack surface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PowerPanel Enterprise systems from untrusted networks.
- Monitor and log all access attempts to the PDNU REST APIs for suspicious activity and alert on unauthorized attempts.
🔍 How to Verify
Check if Vulnerable:
Check the PowerPanel Enterprise version via the admin interface or configuration files; if version is below 2.8.3, it is vulnerable.Check Version:
Check the application's admin panel or configuration file for version information; no standard CLI command is specified.Verify Fix Applied:
After patching, confirm the version is 2.8.3 or higher and test that unauthenticated access to PDNU REST APIs is blocked.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to PDNU REST API endpoints in application logs
- Failed authentication logs for API requests
Network Indicators:
- Unusual traffic patterns to PowerPanel Enterprise API ports from untrusted sources
- HTTP requests to PDNU endpoints without authentication headers
SIEM Query:
source="powerpanel_logs" AND (url_path="/pdnu/*" AND auth_status="failed")🔗 References
- https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
- https://www.tenable.com/security/research/tra-2024-14
- https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
- https://www.tenable.com/security/research/tra-2024-14
