Tollgrade SmartGrid Sensor Management System Software Vulnerabilities

OVERVIEW Independent researcher Maxim Rupp has identified vulnerabilities in Tollgrade Communications, Inc.’s SmartGrid LightHouse Sensor Management System SMS Software EMS. Tollgrade Communications, Inc. has produced an update to mitigate these vulnerabilities. Maxim Rupp has tested the update t...

CVE-2016-5807

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request...

CVE-2016-5797

Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of attempts...

Authentication flaw

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request...

Authentication flaw

Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of attempts...

Authentication flaw

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors...

CVE-2016-5797

CVE-2016-5797 affects Tollgrade LightHouse SMS Software prior to Version 5.1 Patch 3. The issue is information exposure through error messages that reveal whether a username exists, enabling remote account-name enumeration. Affected component is the web-based LightHouse SMS software; the root cau...

CVE-2016-5790

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors...

CVE-2016-5807

CVE-2016-5807 affects Tollgrade LightHouse SMS Software prior to version 5.1 Patch 3. The vulnerability, described as Missing Authentication for Critical Function and Forced Browsing, allows remote authenticated attackers to bypass the administrative-authentication requirement and read or modify ...

CVE-2016-5797

Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of attempts...

CVE-2016-0864

Tollgrade SmartGrid LightHouse Sensor Management System SMS Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors...