What is CVE-2023-3266?

CVE-2023-3266 is a critical-severity vulnerability in Cyberpower Powerpanel Enterprise, classified under CWE-358. CVSS score: 9.8/10. Published 2023-08-14.

How severe is CVE-2023-3266?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Cyberpower Powerpanel Enterprise

CVE-2023-3266

A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also requires the attacker to know at least one username on the device, but any password will authenticate successfully.

EPSS: 0.009 (56.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cyberpower Powerpanel Enterprise — versions v2.6.0
Cyberpower Powerpanel_server

Weakness classification (CWE)

CWE-358

References

trellixpsirt@trellix.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-3266?: CVE-2023-3266 is a critical-severity vulnerability in Cyberpower Powerpanel Enterprise, classified under CWE-358. CVSS score: 9.8/10. Published 2023-08-14.
How severe is CVE-2023-3266?: Critical severity. CVSS v3 base score is 9.8 out of 10.