Auth bypass in Sinapsi Esolar

CVE-2012-5864

These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.

Vulnerability class: Broken Authentication

EPSS: 0.049 (91.2th percentile) — read the EPSS interpretation.

Affected products

Sinapsi Esolar — versions 0
Sinapsi Esolar Duo — versions 0
Sinapsi Esolar Light — versions 0
Sinapsitech Esolar_duo_photovoltaic_system_monitor
Sinapsitech Esolar_light_photovoltaic_system_monitor
Sinapsitech Esolar_photovoltaic_system_monitor
Sinapsitech Sinapsi_firmware

Weakness classification (CWE)

References

ics-cert@hq.dhs.gov (Exploit, exploit, x_refsource_EXPLOIT-DB)
ics-cert@hq.dhs.gov (mailing-list, Exploit, x_refsource_BUGTRAQ)
ics-cert@hq.dhs.gov (vdb-entry, x_refsource_XF)
ics-cert@hq.dhs.gov
ics-cert@hq.dhs.gov (x_refsource_CONFIRM)
af854a3a-2127-422b-91ae-364da2661108 (US Government Resource)
af854a3a-2127-422b-91ae-364da2661108