CVE-2021-34543: Missing Authentication for Critical Function

The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative privileges by connecting to the server. As a result, the attacker can modify configuration files and change the system status. Fixed with...

PT-2021-20538 · Unknown · Solar-Log 500

Name of the Vulnerable Software and Affected Versions: Solar-Log 500 versions prior to 2.8.2 Build 52 Description: The web administration server does not require authentication, allowing remote attackers to gain administrative privileges by connecting to the server. This enables the attacker to...

Solar-Log 500 2.8.2 Incorrect Access Control

Exploit Title: Solar-Log 500 2.8.2 - Incorrect Access Control Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP"" Date: 2021-06-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 - Incorrect Access Control

Exploit Title: Solar-Log 500 2.8.2 - Incorrect Access Control Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP"" Date: 2021-06-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 - Incorrect Access Control Vulnerability

Exploit Title: Solar-Log 500 2.8.2 - Incorrect Access Control Google Dork: In Shodan search engine, the filter is ""Server: email protected"" Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Vulnerability

Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Google Dork: In Shodan search engine, the filter is ""Server: email protected"" Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 - Unprotected Storage of Credentials

Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP"" Date: 2021-06-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solar-Log 500 2.8.2 Password Disclosure

Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP"" Date: 2021-06-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Solare Datensysteme Solar-Log Devices Cross-Site Request Forgery Vulnerability

Solare Datensysteme GmbH is a global service company providing solar monitoring. A cross-site request forgery vulnerability exists in Solare Datensysteme Solar-Log Devices, which can be exploited by an attacker to execute arbitrary script code on a user's browser on an affected website, and can...

Solare Datensysteme Solar-Log Devices 2.8.4-563.5.2-85 - Multiple Vulnerabilities

Solare Datensysteme Solar-Log Devices 2.8.4-563.5.2-85 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Solare Datensysteme GmbH Solar-Log...

Solar-Log CSRF / Information Disclosure / DoS / File Upload

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Solare Datensysteme GmbH Solar-Log 250/300/500/800e/1000/1000 PM+/1200/2000 vulnerable version: Firmware 2.8.4-56 / 3.5.2-85 fixed...

Solare Datensysteme Solar-Log Devices 2.8.4-56 / 3.5.2-85 - Multiple Vulnerabilities

Solare Datensysteme GmbH Solar-Log versions 250, 300, 500, 800e, 1000, 1000 PM+, 1200, and 2000 suffer from cross site request forgery, cross site scripting, file upload, information disclosure, and denial of service vulnerabilities title: Multiple vulnerabilities product: Solare Datensysteme Gmb...

Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Solare Datensysteme GmbH Solar-Log 250/300/500/800e/1000/1000 PM+/1200/2000 vulnerable version: Firmware 2.8.4-56 / 3.5.2-85 fixed...

The vulnerability of the microprogramming software in the Solar-Log photovoltaic system allows a malicious individual to execute arbitrary code and cause malfunctions in the system.

The vulnerability of the Microprogramming Software in the Solar-log photovoltaic system is related to errors in the code of the default web server component used. Exploiting this vulnerability allows a malicious individual to load files by specifying an arbitrary path, including paths to system...

The vulnerability of the microprogramming software in the Solar-Log photovoltaic system allows a remote attacker to gain unauthorized access to confidential information.

The vulnerability of the Microprogramming Software in the Solar-log photovoltaic system arises from the lack of password protection for CGI scripts used for data backup, restoration, and system configuration. Exploiting this vulnerability allows a malicious individual to gain unauthorized access ...

The vulnerability of the Solar-Log WEB monitoring system allows a malicious individual to execute arbitrary SQL commands.

Vulnerability allows remote attackers to execute arbitrary SQL commands using a specially crafted query...

PT-2015-01

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue allows remote attackers to execute arbitrary SQL commands using a specially crafted query. Recommendations At the moment, there is no information about a newer version that...

PT-2014-06

Name of the Vulnerable Software and Affected Versions Solar-log affected versions not specified Description The issue is related to errors in the code of the web server component used by default in the Solar-log photoelectric system. This allows an attacker to upload files to arbitrary paths,...

PT-2014-07

Name of the Vulnerable Software and Affected Versions Solar-log affected versions not specified Description The issue is related to a lack of password protection for CGI scripts used for backup and restoration of data and system configuration in the Solar-log photoelectric system software. This...

PT-2014-08: Password Access in Solar-Log

The specialists of the Positive Research center have detected a Password Access vulnerability in Solar-Log. Application uses some kind of "encryption" for password stored in the configuration file with a static key. Attacker can get a password in plain text. How to fix Update your firmware up to...