CVE-2023-25131CWE-1393

Use of default password vulnerability in CyberPower PowerPanel Business

Critical · published April 24, 2023

CVSS v3.1
9.4
EPSS
1%
Percentile
61.5
In the wild
Unconfirmed
What it is

🚨 Leave your admin password as 'admin' and it's like leaving your front door wide open! This default password vulnerability lets attackers waltz right in and take control. 🔥 Think of it like a hotel that never changes the master key after every guest checks out. Every new guest could walk right into any room! In the same way, untouched default passwords leave your system exposed to unauthorized access. An attacker could log in directly to the server with administrative privileges, which could lead to devastating outcomes like data breaches, system manipulation, or even complete takeover. This is not just a minor oversight; it's a critical security hole!

Put simply

Think of it like a hotel that never changes the master key after every guest checks out. Every new guest could walk right into any room! In the same way, untouched default passwords leave your system exposed to unauthorized access. This vulnerability arises because the PowerPanel Business applications do not prompt users to change the default 'admin' password during installation or first login, allowing attackers to gain unauthorized access.

What to do

An attacker could log in directly to the server with administrative privileges, which could lead to devastating outcomes like data breaches, system manipulation, or even complete takeover. This is not just a minor oversight; it's a critical security hole! Make sure you change the default 'admin' password immediately if you're using version 4.8.6 or earlier of any affected PowerPanel Business application. Additionally, consider enforcing strong password policies and regularly auditing your systems for security compliance. You've got this! By taking these steps, you'll lock down your server and boost your security game! 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00968 · 61.5th percentile
Weakness
CWE-1393 · Use of Default Password
Published
2023-04-24T00:00Z
EPSS history
Timeline
  • 24 APR 00:00Z
    Use of default password vulnerability in CyberPower PowerPanel Business
    cvelistv5