PT-2019-15784 · Fronius · Fronius Solar Inverter

T. Weber · Publicado 2019-12-04 · Atualizado 2019-12-16 · CVE-2019-19228

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fronius Solar Inverter devices versions prior to 3.14.1 (HM 1.12.1)

Description The issue allows attackers to bypass authentication because the password for the today account is stored in the /tmp/web users.conf file.

Recommendations For versions prior to 3.14.1 (HM 1.12.1), update to version 3.14.1 (HM 1.12.1) or later to resolve the issue.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2019-19228

Produtos afetados

Fronius Solar Inverter

Referências · 5

• 🔥 https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228 · Exploit
• 🔥 http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html · Exploit
• 🔥 https://seclists.org/bugtraq/2019/Dec/5 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19228 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19228 · Nota de Segurança