CVE-2023-3265: An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login…

PriorityP268critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.51%

71.2th percentile

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator with hardcoded default credentials.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cyberpower	powerpanel_enterprise	—	—
cyberpower	powerpanel_server	< 2.6.9	2.6.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.