VulnerabilityModified
CVE-2012-5861
These Sinapsi devices do not check the validity of the data before executing queries.
HIGH 7.5EPSS 4.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
These Sinapsi devices do not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication within the device, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 4.24% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- sinapsitech/sinapsi firmware · sinapsitech/esolar duo photovoltaic system monitor · sinapsitech/esolar light photovoltaic system monitor · sinapsitech/esolar photovoltaic system monitor
- Source
- ics-cert@hq.dhs.gov
References
- http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlExploit
- http://www.exploit-db.com/exploits/21273/Exploit
- http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80200
- https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01
- http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlExploit
- http://www.exploit-db.com/exploits/21273/Exploit
- http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdfUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80201
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.