Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.
Solution:
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
| Link | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 | us government resource third party advisory |
| https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads | product |