CVE-2016-2296 Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data...
CriticalCVSS 9.4
EPSS 64.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| meteocontrol weblog basic 100 | All versions | No fix listed |
| meteocontrol weblog light | All versions | No fix listed |
| meteocontrol weblog pro | All versions | No fix listed |
| meteocontrol weblog pro unlimited | All versions | No fix listed |
References
- 20160517 [ICS] Meteocontrol WEB'log Multiple Vulnerabilities mailing-list
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- 39822 exploit