CVE-2024-31409

Published: May 15, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.

Affected (1)

Products: Cyberpower: Powerpanel

Cyberpower

1 product

Powerpanel

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cyberpower Powerpanel	Up to 4.9.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

Source: ics-cert@hq.dhs.gov

Product

https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.