« Volver al listado

CVE-2012-5861

Estado: ModificadaAlta (7.5)—

These Sinapsi devices do not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication within the device, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Sinapsitech — Esolar DUO Photovoltaic System MonitorSinapsitech — Esolar Light Photovoltaic System MonitorSinapsitech — Esolar Photovoltaic System MonitorSinapsitech — Sinapsi Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-5861",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Sinapsi",
          "product": "eSolar",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.2870_xxx_2.2.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sinapsi",
          "product": "eSolar DUO",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.2870_xxx_2.2.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sinapsi",
          "product": "eSolar Light",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.2870_xxx_2.2.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2012-11-23T12:09:58.367",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html",
      "tags": [
        "Exploit"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.exploit-db.com/exploits/21273/",
      "tags": [
        "Exploit"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/21273/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80201",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "These Sinapsi devices do not check the validity of the data before \nexecuting queries. By accessing the SQL table of certain pages that do \nnot require authentication within the device, attackers can leak \ninformation from the device. This could allow the attacker to compromise\n confidentiality."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en el Sinapsi eSolar Light Photovoltaic System Monitor (también conocido como servidor de gestión Schneider Electric Ezylog photovoltaic SCADA ), Sinapsi eSolar, y Sinapsi eSolar DUO con firmware anterior a v2.0.2870_2.2.12 permite a atacantes remotos ejecutar comandos SQL de su elección a través de (1) el parámetro inverterselect en una acción primo para dettagliinverter.php o (2) el parámetro lingua para changelanguagesession.php."
    }
  ],
  "lastModified": "2026-06-16T23:47:28.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sinapsitech:sinapsi_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "382C527D-16D4-4557-8E68-C4430416DB57",
              "versionEndIncluding": "2.0.2870"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF238DD2-D119-4652-B63B-9321DFB01A90"
            },
            {
              "criteria": "cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C00B699F-DE3B-4371-B814-DE54038C60A0"
            },
            {
              "criteria": "cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "288B1E9C-52C3-4ACC-807D-F650B850D874"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}