Parallel Plesk Panel versions 10.4.4 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to an affected system.
Reports indicate attacks on a large number of Internet hosting firms that host servers with an affected version of the vulnerable software. In addition, hackers are selling an exploit that extracts the master password needed to control the affected software.
An unauthenticated, remote attacker can exploit this vulnerability to obtain unauthorized access on an affected version of the software. If successful, the attacker could have a point of entry into a hosting server, which can be leveraged to conduct further attacks on a targeted system or the internal network where the system resides.
Further reports have indicated that the vulnerability has been resolved; however, attackers were able to compromise systems by using sensitive information they obtained, such administrator or user passwords from an affected system that were not reset prior to the mitigation.
Parallel has not confirmed this vulnerability and software updates are not available.
Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.
Administrators are advised to practice strict password management procedures.