I-Panda SolarEagle Authentication Issues / Denial Of Service

title: Multiple vulnerabilities
            product: I-Panda SolarEagle - Solar Controller Administration
                     Software / MPPT Solar Controller SMART2
 vulnerable version: SolarEagle V2.00 / MPPT Solar Controller SMART2
      fixed version: -
         CVE number: -
             impact: Medium
           homepage: http://www.solarcontroller-inverter.com/
              found: 2016-09-03
                 by: T. Weber (Office Vienna)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
                     Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

                     https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"ShenZhen I-Panda Electronics Co. Ltd. is developing power supply devices
such as UPS, power adapter and power inverter and also equipment for solar
systems. This equipment produced by I-Panda comprises solar panels/
controllers/inverters and also solar generator systems."

Source: http://www.solarcontroller-inverter.com/about-us.html


Business recommendation:
------------------------
SEC Consult recommends not to use this product until a thorough security
review has been performed by security professionals and all identified
issues have been resolved.


Vulnerability overview/description:
-----------------------------------
1) Broken Local Admin Authentication in SolarEagle V2.00
Attackers which have access to the locally installed software are able to
bypass the administrative login and can control the MPPT Solar Controller.

2) Missing Server Side Authentication in MPPT Solar Controller SMART2
Attackers which have access to the local network can send their own commands
to the MPPT Solar Controller and are able to control the device this way.

3) Unencrypted Communication in MPPT Solar Controller SMART2
Eavesdropping the communication is possible since unencrypted TCP is used
for all packets which are transferred between the controller and SolarEagle.

4) Denial of Service in MPPT Solar Controller SMART2
Attackers are able to disrupt an active connection as long as they want.


Proof of concept:
-----------------
The vendor was not responsive, hence there is no fix available. The proof of
concept has been removed from this advisory.


Vulnerable / tested versions:
-----------------------------
SolarEagle V2.00 / MPPT Solar Controller SMART2


Vendor contact timeline:
------------------------
2016-09-12: Contacting vendor through email, sending responsible disclosure
            policy, defining release deadline (10th November), asking for
            encryption keys
2016-09-13: Contacting vendor through email, sending responsible disclosure
            policy, defining release deadline (10th November), asking for
            encryption keys
2016-09-13: Vendor: (Instant-Messenger) No encryption available. Offer to
            send the advisory unencrypted; No Answer
2016-10-29: Offer to send the advisory unencrypted; No Answer
2016-11-03: Offer to send the advisory unencrypted; No Answer
2016-11-14: SEC Consult releases security advisory


Solution:
---------
There is no fix available from the vendor as they did not respond.


Workaround:
-----------
No workaround

#  0day.today [2018-01-02]  #