ZeroDay Findings
Sign inSign up

Findings

CVE-2024-51378

CyberPanel Incorrect Default Permissions Vulnerability

Published Oct 29, 2024 · updated Aug 4, 2026 · cyberpanel cyberpanel

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2024 · Catalog

    Detected

    getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versio

  2. Dec 4, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Dec 25, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 4, 2026 · Catalog

    Updated

    getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versio

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Dec 25, 2024

Affected

  • cpe cyberpanel/cyberpanelversion unspecified
  • vendor CyberPersons CyberPanelversion unspecified

Sources

  • CISA KEVCVE-2024-51378

    CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.

    cisa.gov
  • CVE.orgCVE-2024-51378

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-51378

    30-day exploitation probability 94.7%

    first.org
  • Exploit Database52172

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_unix/webapp/cyberpanel_preauth_rce_multi_cve

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2024-51378

    getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST reque

    nvd.nist.gov

References