VulnSocial

CVE-2024-51378Disclosure(cyberpanel / cyberpanel)

LOWCVSS 9.8 · CRITICALCISA KEV

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

cyberpanel CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-12-25. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cyberpanel

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
cyberpanel
Products
cyberpanel

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-11: 1PoC Mentioned / Linked · 2026-08-11: 1Technical Details · 2026-08-11: 108-11
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Zero Day Unit@zero_day_unit
    Disclosure

    ZDU-053 CyberPanel: Bypass de Autenticación y RCE Sin Credenciales — CVSS 10 Crítico https://qma.mx/cve-2024-51378-cyberpanel-bypass-autenticacion-rce-cvss-10/ #Threatintel #Cybersecurity #ZeroDayUnitDay Universe

    Post summary

    The tweet states that a newly discovered vulnerability (CVE‑2024‑51378) in CyberPanel allows unauthenticated authentication bypass and RCE with a CVSS score of 10, but offers no evidence of active exploitation or an available patch.

    0000051
    153 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcyberpanelcyberpanel---

Explore more

Back to dashboardcyberpanel CVEscyberpanel vulnerabilities