PT-2012-6159 · Sinapsi+1 · Sinapsi Esolar Light Photovoltaic System Monitor+3
Ivan Speziale
+1
·
Publicado
2012-11-23
·
Atualizado
2025-07-08
·
CVE-2012-5863
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server) versions prior to 2.0.2870 2.2.12
Sinapsi eSolar versions prior to 2.0.2870 2.2.12
Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12
Description
The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the
ip dominio parameter of the ping.php file.Recommendations
For Sinapsi eSolar Light Photovoltaic System Monitor versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later.
For Sinapsi eSolar versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later.
For Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later.
As a temporary workaround, consider restricting access to the ping.php file to minimize the risk of exploitation.
Avoid using the
ip dominio parameter in the ping.php file until the issue is resolved.Exploit
Correção
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Schneider Electric Ezylog
Sinapsi Esolar
Sinapsi Esolar Duo
Sinapsi Esolar Light Photovoltaic System Monitor