What’s Vulnerable › Vulnerabilities

CVE-2023-0391: MGT-COMMERCE CloudPanel Shared Certificate

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-21 · updated 2026-06-17
• Weakness: CWE-321

Description

MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.

Affected products

• MGT-COMMERCE CloudPanel: before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: MGT-COMMERCE CloudPanel 2.2.1. Check the vendor advisory for mitigations.

References

• https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/
• https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/
• https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/
• https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/

Get alerted when CVE-2023-0391 or the next vulnerability affects your stack