CVE-2023-3267

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with system-level access to the CyberPower PowerPanel Enterprise server.

• CWE-78
• CWE-78

• https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.htmlVendor Advisory
• https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.htmlVendor Advisory

Published

Aug 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32663Incorrect default permissions in some Intel(R) RealSense(TM)…7.8
• CVE-2023-32664A type confusion vulnerability exists in the Javascript chec…7.8
• CVE-2023-32665A flaw was found in GLib. GVariant deserialization is vulner…5.5
• CVE-2023-32666On-chip debug and test interface with improper access contro…7.2
• CVE-2023-32668LuaTeX before 1.17.0 allows a document (compiled with the de…5.5
• CVE-2023-32669Authorization bypass vulnerability in BuddyBoss 2.2.9 versio…5.4
• CVE-2023-32670Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 vers…5.4
• CVE-2023-32671A stored XSS vulnerability has been found on BuddyBoss Platf…5.4
• CVE-2023-32672An Incorrect authorisation check in SQLLab in Apache Superse…4.3
• CVE-2023-32673Certain versions of HP PC Hardware Diagnostics Windows, HP I…9.8
• CVE-2023-32674Certain versions of HP PC Hardware Diagnostics Windows are p…9.8
• CVE-2023-32675Vyper is a pythonic Smart Contract Language for the ethereum…5.3