CyberPower PowerPanel platform - hardcoded database, service and cloud credentials: Hardcoded credentials used

Impact

Hardcoded credentials used by the platform to authenticate to its database, to other services and to CyberPower's cloud. The cloud element is what makes this worth calling out separately: the credential is shared across deployments, so an attacker who extracts it once has a position against many operators' installations at the vendor's back end, not just yours.

Who can reach it

Anyone with the shipped software. The cloud credential in particular is reachable from the internet by design.

What to do

Vendor upgrade is the only fix. Ask the vendor directly whether the cloud-side credential was rotated on their end - your upgrade does not do that. If the answer is unsatisfying, disable the cloud integration.

References