CVE-2024-31409

MEDIUM

CyberPower PowerPanel < 4.9.0 - Incorrect Authorization via MQTT Wildcard Access

Title source: llm
STIX 2.1

Description

Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0035
EPSS Percentile 27.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-863
Status published
Products (1)
cyberpower/powerpanel < 4.9.0
Published May 15, 2024
Tracked Since Feb 18, 2026