CVE-2024-51378: CyberPanel auth bypass and OS command injection in getresetstatus

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote command execution, confirmed in-the-wild exploitation by PSAUX, CISA KEV listing with ransomware use, and EPSS above 0.94.

What it is

CyberPanel before commit 1c0c6cb fails to enforce authentication on the getresetstatus endpoints in dns/views.py and ftp/views.py, because secMiddleware only applies to POST requests. An attacker can reach these endpoints with a non-POST request and inject shell metacharacters through the statusfile property to run arbitrary commands.

Impact

An unauthenticated remote attacker can execute arbitrary operating system commands on the CyberPanel host, leading to full server compromise. The flaw was exploited in the wild in October 2024 by PSAUX and is linked to ransomware use.

Attack surface

Reachable over the network via /dns/getresetstatus or /ftp/getresetstatus; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The bypass works because secMiddleware only guards POST requests, so a non-POST request evades it.

Exploitation

Exploitation is confirmed in the wild: CISA KEV lists it with known ransomware campaign use, and EPSS is 0.94668 (99.852 percentile). Reference tags include Exploit and Press/Media Coverage.

What to do

• Apply the vendor patch (commit 1c0c6cb) or upgrade to a fixed CyberPanel build; versions through 2.3.6 and unpatched 2.3.7 are affected.
• If patching is not immediately possible, restrict network access to the CyberPanel management interface and the /dns/getresetstatus and /ftp/getresetstatus endpoints.
• Follow CISA KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
• Review and harden secMiddleware so authentication is enforced for all HTTP methods, not only POST.
• Assume compromise and rotate credentials and secrets if the host was exposed before patching.

Detection

• Monitor web logs for requests to /dns/getresetstatus or /ftp/getresetstatus, especially non-POST methods.
• Inspect the statusfile parameter for shell metacharacters such as ;, |, $(), backticks, or &&.
• Alert on unexpected child processes spawned by the CyberPanel web service (e.g., shell, curl, wget, nc).
• Hunt for outbound connections or file changes consistent with post-exploitation and ransomware staging on CyberPanel hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.