CVE-2024-51378CyberPanel Incorrect Default Permissions Vulnerability

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

10.0 CRITICALEPSS 94.74%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-08-05 05:16 UTC

OverviewCVSS details

10.0CRITICALCVSS 3.1

Score source: mitre (CNA)
NVD status: Analyzed
Published: Oct 29, 2024
Assigner: mitre

Affected

cyberpanel (cyberpanel)

Versions: before 2.3.8
Fixed in: 2.3.8

Exploitation

Public exploit: Yes · 2 references
CISA KEV: Listed · Dec 4, 2024
KEV due date: Dec 25, 2024
Ransomware use: Known
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

94.74%chance of exploitation in 30 days

Higher than 99.85% of CVEs

CVSS 3.1 · mitre (CNA)

10.0Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 3.1 · mitre (CNA)

10.0Critical

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Attack complexity: Low
Attack vector: Network
Availability impact: High
Confidentiality impact: High
Integrity impact: High
Privileges required: None
Scope: Changed
User interaction: None

CVSS 3.1 · NVD

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
10.0	CRITICAL	3.1mitre (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0	CRITICAL	3.1mitre (CNA)	CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Dec 25, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2024-51378
Status: Analyzed
Assigner (CNA): mitre
Published: Oct 29, 2024
Last modified: 2026-08-05 05:16 UTC
Weaknesses: CWE-78
CWE-276

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:33 UTC.