Meteocontrol WEB'log Information Disclosure Vulnerability

Meteocontrol WEB'log is a web-based SCADA system that provides energy and power configuration management functions using different connected devices. An information disclosure vulnerability exists in multiple Meteocontrol WEB'log products that could be exploited by an unauthorized attacker to gai...

CVE-2016-2298

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors...

CVE-2016-2297

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command shell-like feature."...

CVE-2016-2296

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors...

Authentication flaw

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors...

Improper access control

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command shell-like feature."...

Design/Logic Flaw

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors...

CVE-2016-2296

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors...

CVE-2016-2297

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command shell-like feature."...

CVE-2016-2297

Meteocontrol WEB’log Basic 100, Light, Pro, and Pro Unlimited are affected by CVE-2016-2297 via a hidden/obscured access command shell-like feature that allows remote execution of commands without authentication. The vulnerability, part of an improper access control issue alongside related CVEs i...

CVE-2016-2298

Summary of CVE-2016-2298 (Meteocontrol WEB’log) : Affects WEB’log Basic 100, Light, Pro, and Pro Unlimited. The issue is Information Exposure via cleartext data stored or transmitted by the application, driven by an improper access control / authentication bypass vulnerability. Remote attackers c...

CVE-2016-2298

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors...

Meteocontrol WEB'log Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-133-01 Meteocontrol WEB'log Vulnerabilities that was published May 12, 2016, on the NCCIC/ICS‑CERT web site. Independent researcher Karn Ganeshen has identified one authentication and two information exposure...