SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
CVSS Details
CVSS Score
8.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Configurations (Affected Products)
No configuration data available.
cPanel & WHM < 2026年5月13日安全更新版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import urllib3
# Suppress only the single warning from urllib3 needed.
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def check_ssl_vulnerability(target_url):
"""
POC to check if the target accepts invalid SSL certificates.
If the connection succeeds with verify=False, it demonstrates the vulnerable behavior.
"""
print(f"[*] Testing target: {target_url}")
try:
# Attempt to connect with SSL verification disabled
response = requests.get(target_url, verify=False, timeout=10)
if response.status_code:
print(f"[+] Connection successful (Status: {response.status_code})")
print("[+] The target accepted the connection without strict SSL verification.")
print("[!] This indicates the potential presence of CVE-2026-32992.")
return True
except requests.exceptions.SSLError:
print("[-] SSL Verification failed. Target may not be vulnerable.")
return False
except Exception as e:
print(f"[-] Error occurred: {e}")
return False
if __name__ == "__main__":
# Replace with the actual DNS cluster endpoint of the target
# Example: https://192.168.1.10:2087/json-api/cpanel
target = "https://<target-ip>:2087/json-api/cpanel"
check_ssl_vulnerability(target)