PT-2012-6160 · Sinapsi+1 · Sinapsi Esolar Light Photovoltaic System Monitor+3

Ivan Speziale + 1 · Published 2012-11-23 · Updated 2025-07-08 · CVE-2012-5864

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server) versions prior to 2.0.2870 2.2.12 Sinapsi eSolar versions prior to 2.0.2870 2.2.12 Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12

Description The issue concerns the management web pages of the affected systems, which do not require authentication. This allows remote attackers to gain administrative access by making a direct request, such as to "ping.php".

Recommendations For Sinapsi eSolar Light Photovoltaic System Monitor versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later. For Sinapsi eSolar versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later. For Sinapsi eSolar DUO versions prior to 2.0.2870 2.2.12, update to version 2.0.2870 2.2.12 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-264

CWE-287

Related Identifiers

CVE-2012-5864

Affected Products

Schneider Electric Ezylog

Sinapsi Esolar

Sinapsi Esolar Duo

Sinapsi Esolar Light Photovoltaic System Monitor

References · 10

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html · Exploit
• 🔥 https://exploit-db.com/exploits/21273 · Exploit
• 🔥 http://exploit-db.com/exploits/21273 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5864 · Security Note
• http://sinapsitech.it/default.asp?active_page_id=78&news_id=88 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80200 · Note
• https://t.me/cvenotify/128009 · Telegram Post
• http://us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80203 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-12-325-01 · Note