PT-2017-8771 · Locus Energy+1 · Locus Energy Lgate+1

Daniel Reich · Publicado 2017-02-13 · Atualizado 2017-03-14 · CVE-2016-5782

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Locus Energy LGate versions prior to 1.05H Locus Energy LGate 50 Locus Energy LGate 100 Locus Energy LGate 101 Locus Energy LGate 120 Locus Energy LGate 320

Description An issue was discovered in the PHP script used by Locus Energy meters to manage energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information sent in the POST request.

Recommendations For Locus Energy LGate versions prior to 1.05H, update to version 1.05H or later. For Locus Energy LGate 50, consider disabling the vulnerable PHP script until a patch is available. For Locus Energy LGate 100, restrict access to the PHP script to minimize the risk of exploitation. For Locus Energy LGate 101, avoid using the vulnerable PHP script for voltage monitoring and network configuration until the issue is resolved. For Locus Energy LGate 120, apply configuration changes to properly validate information sent in the POST request. For Locus Energy LGate 320, consider temporarily disabling the PHP script used for managing energy meter parameters until a fix is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-5782

Produtos afetados

Locus Energy Lgate

Php

Referências · 4

• http://securityfocus.com/bid/94782 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5782 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01-0 · Nota
• http://securityfocus.com/bid/94698 · Nota