PT-2012-6158 · Sinapsi+1 · Sinapsi Esolar Light Photovoltaic System Monitor+3

Ivan Speziale + 1 · Published 2012-11-23 · Updated 2025-07-08 · CVE-2012-5862

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server) versions prior to 2.0.2870 2.2.12 Sinapsi eSolar versions prior to 2.0.2870 2.2.12 Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12

Description The issue allows remote attackers to obtain administrative access by leveraging hardcoded accounts in the login.php script. The script contains cleartext passwords or password hashes, making it easier for attackers to gain access. Demonstrated passwords include astridservice or 36e44c9b64.

Recommendations For Sinapsi eSolar Light Photovoltaic System Monitor versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later. For Sinapsi eSolar versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later. For Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later.

Exploit

Fix

Weakness Enumeration

CWE-259

CWE-310

Related Identifiers

CVE-2012-5862

Affected Products

Schneider Electric Ezylog

Sinapsi Esolar

Sinapsi Esolar Duo

Sinapsi Esolar Light Photovoltaic System Monitor

References · 9

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html · Exploit
• 🔥 https://exploit-db.com/exploits/21273 · Exploit
• 🔥 http://exploit-db.com/exploits/21273 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5862 · Security Note
• http://sinapsitech.it/default.asp?active_page_id=78&news_id=88 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80200 · Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf · Note
• https://cisa.gov/news-events/ics-advisories/icsa-12-325-01 · Note
• https://t.me/cvenotify/128007 · Telegram Post