PT-2019-15785

Name of the Vulnerable Software and Affected Versions Fronius Solar Inverter devices versions prior to 3.14.1 HM 1.12.1 Description The issue allows for directory traversal via the action=download&filename= parameter in the admincgi-bin/service.fcgi endpoint. This could potentially lead to...

CVE-2019-19228: Cleartext Storage of Sensitive Information

Fronius Solar Inverter devices before 3.14.1 HM 1.12.1 allow attackers to bypass authentication because the password for the today account is stored in the /tmp/webusers.conf file...

CVE-2019-19229: Improper Limitation of a Pathname to a Restricted Directory

admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 HM 1.12.1 allows action=download&filename= Directory Traversal...

Fronius Solar Inverter Series Path Traversal Vulnerability

The Fronius Solar Inverter is a photovoltaic inverter device from the Austrian company Fronius. A path traversal vulnerability exists in admincgi-bin/service.fcgi in versions prior to Fronius Solar Inverter 3.14.1 HM 1.12.1. The vulnerability stems from a failure of a network system or product to...

Fronius Solar Inverter Series Backdoor Account Vulnerability

The Fronius Solar Inverter is a photovoltaic inverter device from the Austrian company Fronius. A security vulnerability exists in Fronius Solar Inverter versions prior to 3.14.1 HM 1.12.1, which stems from the program storing the 'today' account password in the /tmp/webusers.conf file. An attack...

Fronius Solar Inverter Series Insecure Communication / Path Traversal

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilites product: Fronius Solar Inverter Series vulnerable version: SW Version =3.14.1 vuln 2: 3.12.5 - HM 1.10.5, see solution section below CVE number:...

fronius.com XSS vulnerability

Vulnerable URL: http://www.fronius.com/cps/rde/xchg/SID-D84F36DA-23354C82/froniusinternational/hs.xsl/68searchENGHTML.htm?query="-alert/OPENBUGBOUNTY/-"=ENGsubmitsearch=Suche Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:51 GMT Vulnerabili...

CVE-2023-37621

CVE-2023-37621 : Multiple sources tie this entry to Fronius Datalogger Web, specifically version 2.0.5-4 . The reported issue is Cross-Site Request Forgery (CSRF) that can allow remote attackers to obtain sensitive information via a crafted request. PT-Security states there is no known fix for ve...