CVE-2016-5782

The CVE affects Locus Energy LGate devices (LGate firmware prior to 1.05H and models 50, 100, 101, 120, 320). The root cause is improper validation of POST data in the PHP-based web interface, enabling command injection via the LGate web server. Impact: remote, unauthenticated attackers could exe...

PT-2017-8771

Name of the Vulnerable Software and Affected Versions Locus Energy LGate versions prior to 1.05H Locus Energy LGate 50 Locus Energy LGate 100 Locus Energy LGate 101 Locus Energy LGate 120 Locus Energy LGate 320 Description An issue was discovered in the PHP script used by Locus Energy meters to...

CVE-2016-5782: Improper Input Validation

An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information...

Carlo Gavazzi Energy Meters - Login Brute Force, Extract Info and Dump Plant Database

This module scans for Carlo Gavazzi Energy Meters login portals, performs a login brute force attack, enumerates device firmware version, and attempt to extract the SMTP configuration. A valid, admin privileged user is required to extract the SMTP password. In some older firmware versions, the SM...

ICSA-17-038-01_Sielco Sistemi Winlog SCADA Software

CVSS v3 7.2 Vendor: Sielco Sistemi Equipment: Winlog SCADA Software Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following Sielco Sistemi products are affected: Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro SCADA Software, versions prior to...

Honeywell XL Web II Controller Vulnerabilities

OVERVIEW Independent researcher Maxim Rupp has identified vulnerabilities in Honeywell’s XL Web II controller application. Honeywell has produced a new version to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following XL Web II controlle...

KillDisk Ransomware Targets Linux; Demands $250,000 Ransom, But Won't Decrypt Files

What you'll do if Ransomware infects you? Should you pay or not to recover your files? Believe me, the FBI advises - Pay off the criminals to get your files back if you don't have a backup. But paying off a ransom to cyber criminals is definitely not a wise option because there is no guarantee...

bordgaisenergy.ie XSS vulnerability

Vulnerable URL: http://www.bordgaisenergy.ie/search.php?q=moving=1=all=10=281 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 162422 VIP website status:| No Check bordgaisenergy.ie...

ABB Panel Builder 800 DLL Hijacking Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-077-01 ABB Panel Builder 800 DLL Hijacking Vulnerability that was published March 17, 2016, on the NCCIC/ICS-CERT web site. Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in the ABB...

Multiple Locus Energy LGate Products OS Command Injection Vulnerabilities

Locus Energy LGate is a web-based data collection system from Locus Energy, Inc. An input validation vulnerability exists in multiple Locus Energy LGate products, which allows remote attackers to submit a special request, inject and execute arbitrary commands...

Some Solar Power Meters are Vulnerable to Command Injection Attacks

Solar software and analytics firm Locus Energy has pushed out a patch to its residential and commercial power meters to address a vulnerability that could allow hackers to access equipment and remotely execute code. According to independent security researcher Daniel Reich, who privately disclose...

cpsenergy.com XSS vulnerability

Vulnerable URL: https://cpsenergy.com/en/solrsearch.html?q=prompt/XSSPOSED/...

mail.redlandenergy.com XSS vulnerability

Open Bug Bounty ID: OBB-193082 Description| Value ---|--- Affected Website:| mail.redlandenergy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

linnenergy.com XSS vulnerability

Vulnerable URL: http://www.linnenergy.com/search-results/?search=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3EStart+typing Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

Nuclear Power Plant Disrupted by Cyber Attack

The head of an international nuclear energy consortium said this week that a cyber attack caused a “disruption” at a nuclear power plant at some point during the last several years. Yukiya Amano, the head of the International Atomic Energy Agency IAEA didn’t go into detail about the attack, but...

ICS-CERT Report Grim Reminder of State of Critical Infrastructure Security

U.S. critical infrastructure got another reminder this week that it needs to do more to protect itself from cyber attacks with the release of an annual government report. The NCCIC/ICS-CERT FY 2015 Annual Vulnerability Coordination Report points out that nagging issues continue to plague industri...

FENIKS PRO ElNet LT Energy & Power analyzer authentication bypass vulnerability

FENIKS PRO ElNet LT Energy & Power analyzer is an energy and power analyzer product from FENIKS PRO, Slovenia. An authentication bypass vulnerability exists in FENIKS PRO ElNet LT Energy & Power analyzer. An attacker could use this vulnerability to bypass the authentication mechanism and obtain...

How to Hack Smart Bluetooth Locks and IoT Devices — Check this Out

Bluetooth Low Energy, also known as Bluetooth Smart or Bluetooth 4, is the leading protocol designed for connecting IoT devices, medical equipment, smart homes and like most emerging technologies, security is often an afterthought. As devices become more and more embedded in our daily lives,...

MITM BLE Security Assessment: gattacker

MITM BLE Security Assessment A Node.js package for BLE Bluetooth Low Energy Man-in-the-Middle & more The tool creates exact copy of attacked device in Bluetooth layer, and then tricks mobile application to interpret its broadcasts and connect to it instead the original device. At the same time, i...

Powerlogic / Schneider Electric IONXXXX CSRF / Missing Access Controls

Powerlogic/Schneider Electric IONXXXX series Smart Meters - Multiple security issues Impacted devices: ION7300 and potentially all IONXXXX models based off of Powerlogic For example, Power Measurement Ltd. Meter ION 7330V283 ETH ETH7330V274...