PT-2017-8771 · Locus Energy+1 · Locus Energy Lgate+1

Daniel Reich · Published 2017-02-13 · Updated 2017-03-14 · CVE-2016-5782

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Locus Energy LGate versions prior to 1.05H Locus Energy LGate 50 Locus Energy LGate 100 Locus Energy LGate 101 Locus Energy LGate 120 Locus Energy LGate 320

Description An issue was discovered in the PHP script used by Locus Energy meters to manage energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information sent in the POST request.

Recommendations For Locus Energy LGate versions prior to 1.05H, update to version 1.05H or later. For Locus Energy LGate 50, consider disabling the vulnerable PHP script until a patch is available. For Locus Energy LGate 100, restrict access to the PHP script to minimize the risk of exploitation. For Locus Energy LGate 101, avoid using the vulnerable PHP script for voltage monitoring and network configuration until the issue is resolved. For Locus Energy LGate 120, apply configuration changes to properly validate information sent in the POST request. For Locus Energy LGate 320, consider temporarily disabling the PHP script used for managing energy meter parameters until a fix is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-5782

Affected Products

Locus Energy Lgate

Php

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-5782 · Security Note
• http://securityfocus.com/bid/94782 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01-0 · Note
• http://securityfocus.com/bid/94698 · Note