Security readout for executives and security teams
Plain-English summary
CyberPanel has a critical flaw that let unauthenticated remote attackers run commands on affected servers. Public sources state it was exploited in October 2024 by PSAUX ransomware, and CISA lists it as known exploited. Internet-exposed CyberPanel instances should be treated as urgent compromise-risk assets.
Executive priority
Immediate priority for any organization running CyberPanel. Because exploitation is confirmed and impact is full command execution, patching alone may not be enough; exposed vulnerable servers should also be investigated for compromise and ransomware impact.
Technical view
CVE-2024-51567 affects CyberPanel before commit 5b08cd6, including versions through 2.3.6 and unpatched 2.3.7. The issue is in databases/views.py, where /dataBases/upgrademysqlstatus can bypass authentication and allow command execution through the statusfile property. CVSS is 10.0 with network, unauthenticated exploitation.
Likely exposure
Highest exposure is CyberPanel administration interfaces reachable from the internet, especially versions through 2.3.6 or unpatched 2.3.7. Internal-only panels still matter because successful exploitation can provide server-level command execution. Product inventory should focus on CyberPanel-managed hosting servers and VPS control panels.
Exploitation context
Active exploitation is supported by CISA KEV and public reporting describing a PSAUX ransomware campaign against CyberPanel instances. BleepingComputer reported mass targeting of about 22,000 instances. Treat exposed vulnerable systems as potentially targeted, not theoretical.
Researcher notes
The public record identifies an authentication bypass plus command execution path in CyberPanel’s upgrademysqlstatus handler. Sources name affected versions but not every downstream package state. Avoid assuming a server is safe based only on version labels; verify the patch commit or vendor-fixed build.
Mitigation direction
- Upgrade CyberPanel to a vendor-fixed release containing commit 5b08cd6 or later.
- Review CyberPanel’s security issue blog and changelog for current upgrade guidance.
- Remove public exposure of the CyberPanel management interface where business operations allow.
- Investigate affected hosts for compromise before returning them to service.
- Rotate credentials and secrets on systems where compromise is suspected.
Validation and detection
- Inventory all CyberPanel servers and record exact installed versions.
- Confirm whether the installed code includes commit 5b08cd6 or later vendor fixes.
- Check access logs for requests to /dataBases/upgrademysqlstatus.
- Review process, web, and system logs for unusual command execution around October 2024 onward.
- Confirm internet exposure using approved asset management or external attack surface tools.
Public sources used
The source record changed after analysis. Treat this automated context as pending refresh.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-51567 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N3.96mitreVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE publishedCVE Program
The CVE record was published.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-51567 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2024-11-07T00:00:00.000Z: CVE-2024-51567 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://cwe.mitre.org/data/definitions/78.htmlCVE reference, mitre
- https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rceCVE reference, mitre
- https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515CVE reference, mitre
- https://cyberpanel.net/KnowledgeBase/home/change-logs/CVE reference, mitre
- https://cwe.mitre.org/data/definitions/420.htmlCVE reference, mitre
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanelCVE reference, mitre
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/CVE reference, mitre
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51567CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.