What’s Vulnerable › Vulnerabilities

CVE-2023-25132: Unrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel Business

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-24 · updated 2026-06-17
• Weakness: CWE-434

Description

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.

Affected products

• CyberPower PowerPanel business: through 4.8.6

References

• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
• https://zuso.ai/Advisory/
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
• https://zuso.ai/Advisory/

Get alerted when CVE-2023-25132 or the next vulnerability affects your stack