CVE の説明
Sinapsi eSolar Hard-Coded Password
These Sinapsi devices store hard-coded passwords in the PHP file of the device. By using the hard-coded passwords in the device, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.CVE の解決策
Sinapsi has developed a new firmware version 2.0.2870_2.2.12 that
mitigates these vulnerabilities. Sinapsi released the new firmware on
Monday, November 19, 2012 directly to the devices. Users will be able to
manually download the firmware on their device by using the Firmware
Update function in the System Menu in the device’s Web interface.
Sinapsi has also posted a security newsletter to its public Web site http://www.sinapsitech.it/default.asp .Other affected vendors have been notified by Sinapsi and ICS-CERT,
but the availability of new firmware upgrades are unknown by ICS-CERT at
this time.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Use of Hard-coded Password The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound authentication to external components. |
||
| Category : Cryptographic Issues Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed. |
メトリクス
| メトリクス | スコア | 深刻度 | CVSS ベクター | 出典 |
|---|---|---|---|---|
| V2 | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
EPSS
EPSSは脆弱性が悪用される可能性を予測するスコアリングモデルです。
EPSSスコア
EPSSモデルは0から1（0〜100%）の確率スコアを算出します。スコアが高いほど、脆弱性が悪用される可能性が高いことを示します。
EPSSパーセンタイル
パーセンタイルはCVEをEPSSスコアで順位付けするために使用されます。例えば、EPSSスコアで95パーセンタイルにあるCVEは、他の95%のCVEよりも悪用される可能性が高いことを意味します。パーセンタイルはCVEのEPSSスコアを他のCVEと比較するために使用されます。
エクスプロイト情報
Exploit Database EDB-ID : 21273
公開日 : 2012-09-11 22h00 +00:00
著者 : Roberto Paleari
EDB検証済み : No
関連製品
構成 0
Sinapsitech>>Sinapsi_firmware >> Version ～まで（含む） 2.0.2870
Sinapsitech>>Esolar_duo_photovoltaic_system_monitor >> Version -
Sinapsitech>>Esolar_light_photovoltaic_system_monitor >> Version -
Sinapsitech>>Esolar_photovoltaic_system_monitor >> Version -
参考資料
http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
