Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server.
Solution:
The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
| Link | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 | us government resource third party advisory |
| https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads | product |