Lucene search

[email protected]CVE-2012-5863

HistoryNov 23, 2012 - 12:09 p.m.

CVE-2012-5863

2012-11-2312:09:58

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-5863

sinapsi esolar

schneider electric ezylog

photovoltaic system monitor

scada

security vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8 High

AI Score

Confidence

Low

0.27 Low

EPSS

Percentile

96.8%

JSON

ping.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip_dominio parameter.

Affected configurations

NVD

Node

sinapsitechsinapsi_firmwareRange≤2.0.2870

AND

sinapsitechesolar_duo_photovoltaic_system_monitorMatch-

sinapsitechesolar_light_photovoltaic_system_monitorMatch-

sinapsitechesolar_photovoltaic_system_monitorMatch-

CPENameOperatorVersion
sinapsitech:sinapsi_firmwaresinapsitech sinapsi firmwarele2.0.2870
sinapsitech:esolar_duo_photovoltaic_system_monitorsinapsitech esolar duo photovoltaic system monitoreq-
sinapsitech:esolar_light_photovoltaic_system_monitorsinapsitech esolar light photovoltaic system monitoreq-
sinapsitech:esolar_photovoltaic_system_monitorsinapsitech esolar photovoltaic system monitoreq-

CPE	Name	Operator	Version
sinapsitech:sinapsi_firmware	sinapsitech sinapsi firmware	le	2.0.2870
sinapsitech:esolar_duo_photovoltaic_system_monitor	sinapsitech esolar duo photovoltaic system monitor	eq	-
sinapsitech:esolar_light_photovoltaic_system_monitor	sinapsitech esolar light photovoltaic system monitor	eq	-
sinapsitech:esolar_photovoltaic_system_monitor	sinapsitech esolar photovoltaic system monitor	eq	-

References

archives.neohapsis.com/archives/bugtraq/2012-09/0045.html

www.exploit-db.com/exploits/21273/

www.sinapsitech.it/default.asp?active_page_id=78&news_id=88

www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/80202

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8 High

AI Score

Confidence

Low

0.27 Low

EPSS

Percentile

96.8%

JSON

Related for CVE-2012-5863

nvd1 prion1 cvelist1 ics1