Exploited vulnerability

CVE-2024-51378

TLP:CLEAR

CyberPanel Incorrect Default Permissions Vulnerability

CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.

Facts

Vendor: CyberPersons
Product: CyberPanel
CVSS: 10
EPSS (probability of exploitation within 30 days): 94.7 %
On CISA's Known Exploited Vulnerabilities list since: 4 December 2024
First known exploitation: 4 December 2024
Used in ransomware campaigns (per CISA): Yes
CISA's deadline for US federal agencies: 25 December 2024
Weakness: CWE-276
First seen by Risk Letters: 4 December 2024

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD