CVE-2024-33615

Published: May 15, 2024Modified: Jun 17, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: ics-cert@hq.dhs.gov (Secondary)

Description

A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution.

Related CWEs

CWE-23

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (4)

https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

Source: ics-cert@hq.dhs.gov

https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

Source: ics-cert@hq.dhs.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.