PT-2014-06 · Solar-Log · Solar-Log

Published 2014-04-11 · Updated 2014-04-11

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Solar-log (affected versions not specified)

Description The issue is related to errors in the code of the web server component used by default in the Solar-log photoelectric system. This allows an attacker to upload files to arbitrary paths, including system files, without authentication or by using a fixed solarlog:solarlog account. The issue can lead to the execution of arbitrary code and/or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2014-00401

Affected Products

Solar-Log

References · 5

• https://bdu.fstec.ru/vul/2014-00401 · Security Note
• http://securitylab.ru/lab/PT-2014-06 · Note
• http://osvdb.org/show/osvdb/106641 · Note
• http://securityfocus.com/bid/67455 · Note
• http://secunia.com/advisories/58396 · Note