{"id":"CVE-2024-51378","aliases":["EUVD-2024-45807","GHSA-c45f-33wq-x2qc"],"status":"published","title":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb...","description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.94748,"percentile":0.99859,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-276","CWE-77","CWE-78"],"published":"2024-10-29T00:00:00Z","modified":"2026-10-28T02:31:03Z","kev":{"date_added":"2024-12-04","due_date":"2024-12-25","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-12-04"},{"source":"kev","since":"2024-12-04"}],"exploits":[{"source":"metasploit","id":"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve","title":"CyberPanel Multi CVE Pre-auth RCE","type":"exploit","platform":"Linux,Unix","date":"2024-10-27","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve"},{"source":"pocgithub","id":"refr4g/CVE-2024-51378","title":"refr4g/CVE-2024-51378","date":"2024-10-29","url":"https://github.com/refr4g/CVE-2024-51378"},{"source":"pocgithub","id":"qnole000/CVE-2024-51378","title":"qnole000/CVE-2024-51378","date":"2025-02-12","url":"https://github.com/qnole000/CVE-2024-51378"},{"source":"exploitdb","id":"EDB-52172","title":"CyberPanel 2.3.6 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2025-04-11","url":"https://www.exploit-db.com/exploits/52172"},{"source":"pocgithub","id":"rimbadirgantara/CVE-2024-51378","title":"rimbadirgantara/CVE-2024-51378","date":"2025-11-11","url":"https://github.com/rimbadirgantara/CVE-2024-51378"},{"source":"nuclei","id":"CVE-2024-51378","title":"CyberPanel - Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51378.yaml"}],"products":[{"vendor":"cyberpanel","product":"cyberpanel"},{"vendor":"cyberpersons","product":"cyberpanel"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/78.html","tags":["Not Applicable","web"]},{"url":"https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683","tags":["Patch","fix"]},{"url":"https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/","tags":["Exploit","web"]},{"url":"https://cyberpanel.net/KnowledgeBase/home/change-logs/","tags":["Release Notes","web"]},{"url":"https://cwe.mitre.org/data/definitions/420.html","tags":["Not Applicable","web"]},{"url":"https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel","tags":["Product","article"]},{"url":"https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/","tags":["Exploit","Press/Media Coverage","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51378","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51378","tags":["advisory"]},{"url":"https://cyberpanel.net/KnowledgeBase/home/change-logs"},{"url":"https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability"},{"url":"https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances"},{"url":"https://github.com/advisories/GHSA-c45f-33wq-x2qc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51378.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-51378","description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-08-05T03:55:57.046Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:01.972857Z"}],"euvd":[{"id":"EUVD-2024-45807","description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-08-05T03:55:57Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical"}],"exploited_since":"2024-12-04","updated_at":"2026-11-02T18:02:22.516769Z"}],"ghsa":[{"id":"GHSA-c45f-33wq-x2qc","title":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb...","description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.","status":"published","published":"2024-10-30T00:31:05Z","modified":"2025-10-22T00:33:12Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78","CWE-276"],"updated_at":"2026-11-02T15:04:07.67458Z"}],"kev":[{"id":"CVE-2024-51378","title":"CyberPanel Incorrect Default Permissions Vulnerability","description":"CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.","cwes":["CWE-276"],"kev":{"date_added":"2024-12-04","due_date":"2024-12-25","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-51378","description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.","status":"published","published":"2024-10-29T23:15:04.083Z","modified":"2026-08-05T05:16:41.87Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:35.289159Z"}],"osv":[{"id":"CVE-2024-51378","description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-10-28T02:31:03.844038794Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical"}],"updated_at":"2026-11-02T15:44:44.032344Z"}]}}