Code injection

2012-11-2312:09:00

PRIOn knowledge base

www.prio-n.com

8.3 High

AI Score

Confidence

Low

0.27 Low

EPSS

Percentile

96.8%

JSON

ping.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip_dominio parameter.

CPENameOperatorVersion
sinapsi_firmwarele2.0.2870

CPE	Name	Operator	Version
	sinapsi_firmware	le	2.0.2870

References

archives.neohapsis.com/archives/bugtraq/2012-09/0045.html

www.sinapsitech.it/default.asp?active_page_id=78&news_id=88

www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/80202

www.exploit-db.com/exploits/21273/