PT-2012-6160 · Sinapsi+1 · Sinapsi Esolar Light Photovoltaic System Monitor+3

Ivan Speziale

+1

·

Publicado

2012-11-23

·

Atualizado

2025-07-08

·

CVE-2012-5864

CVSS v2.0

9.4

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server) versions prior to 2.0.2870 2.2.12 Sinapsi eSolar versions prior to 2.0.2870 2.2.12 Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12
Description The issue concerns the management web pages of the affected systems, which do not require authentication. This allows remote attackers to gain administrative access by making a direct request, such as to "ping.php".
Recommendations For Sinapsi eSolar Light Photovoltaic System Monitor versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later. For Sinapsi eSolar versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later. For Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later.

Exploit

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-287

Identificadores relacionados

CVE-2012-5864

Produtos afetados

Schneider Electric Ezylog
Sinapsi Esolar
Sinapsi Esolar Duo
Sinapsi Esolar Light Photovoltaic System Monitor