EUVD-2012-0237

Malware in sbrugna...

Eaton Lighting Systems EG2 Web Control Authentication Bypass Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on March 1, 2016, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified vulnerabilities in Eaton Lighting Systems’ EG2 Web Control application. Eaton Lighting Systems...

CVE-2016-2272

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

CVE-2016-2272

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

CVE-2016-0871

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

Design/Logic Flaw

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

Code injection

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

CVE-2016-0871

The CVE-2016-0871 issue affects Eaton Lighting EG2 Web Control (V4.04P and prior). Root causes include CWE-565: Reliance on Cookies without Validation, and CWE-312: Cleartext Storage of Sensitive Information. A remote attacker could read configuration files and view credentials via a direct reque...

CVE-2016-2272

CVE-2016-2272 affects Eaton Lighting EG2 Web Control versions 4.04P and earlier. The ICS advisory notes an authentication bypass/root cause: reliance on cookies without proper validation/integrity, enabling a remote attacker to alter browser cookies and perform administrative actions that could c...

CVE-2016-0871: Exposure of Sensitive Information to an Unauthorized Actor

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

CVE-2016-2272: Improper Access Control

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

PT-2016-4434

Name of the Vulnerable Software and Affected Versions Eaton Lighting EG2 Web Control versions 4.04P and earlier Description The issue allows remote attackers to read the configuration file, which can lead to the discovery of credentials, by making a direct request. Recommendations For versions...

Eaton Lighting Systems EG2 Web Control Authentication Bypass Vulnerability (CNVD-2016-02006)

The Eaton Lighting Systems EG2 Web Control is a controller product from Eaton Lighting Systems USA for Internet and Wi-Fi LAN connections to the iLumin network. An authentication bypass vulnerability exists in Eaton Lighting Systems EG2 Web Control version 4.04P and earlier. A remote attacker cou...

PT-2016-5081

Name of the Vulnerable Software and Affected Versions Eaton Lighting EG2 Web Control versions 4.04P and earlier Description The issue allows remote attackers to have an unspecified impact via a modified cookie. Recommendations For versions 4.04P and earlier, at the moment, there is no information...

Sql injection

Multiple SQL injection vulnerabilities in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allow remote attackers to execute arbitrary SQL commands via 1 a SOAP message to the Printer.getPrinterAgentKey function in the SoapServlet servlet, 2 the User.updateUserValue functio...