CVE-2024-51378

Original summary

Normalized public record · Updated Oct 22, 2026

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Publisher and source text is retained separately from QFinch interpretation.

Affected products

Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.

Remediation

Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.

1. Confirm the affected product and reachable code path exist in your environment.
2. Apply the vendor-supported patch or mitigation from the primary advisory.
3. Rescan the exact deployed revision and retain verification evidence.

Evidence coverage

SSVC priority

IMMEDIATE

Confidence

100%

Aliases

None reported

Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.

Sources and record history

1. cwe.mitre.org ↗
2. Patch commit ↗
3. refr4g.github.io ↗
4. cyberpanel.net ↗
5. cwe.mitre.org ↗
6. cyberpanel.net ↗
7. www.bleepingcomputer.com ↗
8. CISA advisory ↗

Record history

Published Oct 29, 2024 · Last refreshed Oct 22, 2026