CVE-2024-32042: 
Homebrew vulnerability analysis and mitigation

The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered. This vulnerability (CVE-2024-32042) affects CyberPower PowerPanel business versions 4.9.0 and prior. The vulnerability was disclosed on May 15, 2024, and has been assigned a CVSS v3.1 base score of 4.9 (Medium) (ICS-CERT).

The vulnerability is classified as CWE-257 (Storing Passwords in a Recoverable Format). The CVSS vector string is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating that the vulnerability is network accessible, requires high privileges, needs no user interaction, and can lead to high confidentiality impact without affecting integrity or availability (ICS-CERT).

If exploited, this vulnerability could allow an attacker to recover passwords stored in the database, potentially leading to unauthorized access with user or administrator privileges. This could compromise the security of the PowerPanel business application and connected systems (ICS-CERT).

The vulnerability requires high privileges to exploit, suggesting that an attacker would need significant access to the system before being able to leverage this vulnerability. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time (ICS-CERT).

CyberPower has released version 4.10.1 of PowerPanel business that fixes this vulnerability. Users are advised to update to v4.10.1 or later version. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks and remote devices behind firewalls and isolating them from business networks (ICS-CERT).