VulnerabilityModified
CVE-2012-5864
By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.
HIGH 10.0EPSS 4.91%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 4.91% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-264
- Affected
- sinapsitech/sinapsi firmware · sinapsitech/esolar duo photovoltaic system monitor · sinapsitech/esolar light photovoltaic system monitor · sinapsitech/esolar photovoltaic system monitor
- Source
- ics-cert@hq.dhs.gov
References
- http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlExploit
- http://www.exploit-db.com/exploits/21273/Exploit
- http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80200
- https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01
- http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlExploit
- http://www.exploit-db.com/exploits/21273/Exploit
- http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdfUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80203
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.