Lucene search

[email protected]CVE-2012-5864

HistoryNov 23, 2012 - 12:09 p.m.

CVE-2012-5864

2012-11-2312:09:58

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-5864

sinapsi esolar

schneider electric

ezylog

photovoltaic

scada

remote access

authentication

ping.php

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.9 Medium

AI Score

Confidence

Low

0.022 Low

EPSS

Percentile

89.6%

JSON

The management web pages on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 do not require authentication, which allows remote attackers to obtain administrative access via a direct request, as demonstrated by a request to ping.php.

Affected configurations

NVD

Node

sinapsitechsinapsi_firmwareRange≤2.0.2870

AND

sinapsitechesolar_duo_photovoltaic_system_monitorMatch-

sinapsitechesolar_light_photovoltaic_system_monitorMatch-

sinapsitechesolar_photovoltaic_system_monitorMatch-

CPENameOperatorVersion
sinapsitech:sinapsi_firmwaresinapsitech sinapsi firmwarele2.0.2870
sinapsitech:esolar_duo_photovoltaic_system_monitorsinapsitech esolar duo photovoltaic system monitoreq-
sinapsitech:esolar_light_photovoltaic_system_monitorsinapsitech esolar light photovoltaic system monitoreq-
sinapsitech:esolar_photovoltaic_system_monitorsinapsitech esolar photovoltaic system monitoreq-

CPE	Name	Operator	Version
sinapsitech:sinapsi_firmware	sinapsitech sinapsi firmware	le	2.0.2870
sinapsitech:esolar_duo_photovoltaic_system_monitor	sinapsitech esolar duo photovoltaic system monitor	eq	-
sinapsitech:esolar_light_photovoltaic_system_monitor	sinapsitech esolar light photovoltaic system monitor	eq	-
sinapsitech:esolar_photovoltaic_system_monitor	sinapsitech esolar photovoltaic system monitor	eq	-

References

archives.neohapsis.com/archives/bugtraq/2012-09/0045.html

www.exploit-db.com/exploits/21273/

www.sinapsitech.it/default.asp?active_page_id=78&news_id=88

www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/80203

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.9 Medium

AI Score

Confidence

Low

0.022 Low

EPSS

Percentile

89.6%

JSON

Related for CVE-2012-5864

prion1 cvelist1 nvd1 ics1