CVE-2012-5863 Sinapsi eSolar OS Command Injection
HighCVSS 10.0
EPSS 24.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
These Sinapsi devices do not check for special elements in commands sent
to the system. By accessing certain pages with administrative privileges
that do not require authentication within the device, attackers can
execute arbitrary, unexpected, or dangerous commands directly onto the
operating system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sinapsitech sinapsi firmware | <= 2.0.2870 | No fix listed |
| sinapsitech esolar duo photovoltaic system monitor | All versions | No fix listed |
| sinapsitech esolar light photovoltaic system monitor | All versions | No fix listed |
| sinapsitech esolar photovoltaic system monitor | All versions | No fix listed |
| sinapsi eSolar | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsi eSolar DUO | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsi eSolar Light | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
References
- 20120911 Multiple vulnerabilities in Ezylog photovoltaic management server exploit mailing-list
- 21273 exploit
- www.sinapsitech.it
- sinapsi-default-password(80200) vdb-entry
- www.cisa.gov
- www.us-cert.gov us-government-resource
- sinapsi-ping-command-exec(80202) vdb-entry