CVE-2012-5864 Sinapsi eSolar Improper Authentication
Attackers can gain unauthorized administrative access to Sinapsi eSolar devices by directly visiting internal pages without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-5864?
CVE-2012-5864 is a critical missing authorization vulnerability in Sinapsi eSolar, published on 23 Nov 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.
Which versions are affected by CVE-2012-5864?
It affects 4 products.
Products include Sinapsitech Esolar Duo Photovoltaic System Monitor, Sinapsitech Esolar Light Photovoltaic System Monitor, Sinapsitech Esolar Photovoltaic System Monitor, Sinapsitech Sinapsi Firmware.
How do I fix CVE-2012-5864?
No fix has been published for CVE-2012-5864 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2012-5864 being exploited?
There is no known exploitation of CVE-2012-5864 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Sinapsi eSolar
Sources
Also known as GHSA-v26h-2hg9-6mq7.