« Volver al listado

CVE-2012-5862

Estado: ModificadaAlta (10)—

These Sinapsi devices store hard-coded passwords in the PHP file of the device. By using the hard-coded passwords in the device, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Sinapsitech — Esolar DUO Photovoltaic System MonitorSinapsitech — Esolar Light Photovoltaic System MonitorSinapsitech — Esolar Photovoltaic System MonitorSinapsitech — Sinapsi Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-5862",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Sinapsi",
          "product": "eSolar",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.2870_xxx_2.2.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sinapsi",
          "product": "eSolar DUO",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.2870_xxx_2.2.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sinapsi",
          "product": "eSolar Light",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.2870_xxx_2.2.12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2012-11-23T12:09:58.430",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html",
      "tags": [
        "Exploit"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.exploit-db.com/exploits/21273/",
      "tags": [
        "Exploit"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01",
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/21273/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-259"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "These Sinapsi devices\nstore hard-coded passwords in the PHP file of the device. By using the \nhard-coded passwords in the device, attackers can log into the device \nwith administrative privileges. This could allow the attacker to have \nunauthorized access."
    },
    {
      "lang": "es",
      "value": "login.php en el Sinapsi eSolar Light Photovoltaic System Monitor (también conocido como servidor de gestión Schneider Electric Ezylog photovoltaic SCADA), Sinapsi eSolar, y Sinapsi eSolar DUO con firmware anterior a v2.0.2870_2.2.12 establece múltiples cuentas grabadas en memoria, lo que hace fácil a atacantes remotos obtener acceso administrativo mediante (1) la obtención de contraseñas en texto plano o (2) el hash de la contraseña en este script, como se demostró por una contraseña de astridservice o 36e44c9b64."
    }
  ],
  "lastModified": "2026-06-16T23:47:28.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sinapsitech:sinapsi_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "382C527D-16D4-4557-8E68-C4430416DB57",
              "versionEndIncluding": "2.0.2870"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF238DD2-D119-4652-B63B-9321DFB01A90"
            },
            {
              "criteria": "cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C00B699F-DE3B-4371-B814-DE54038C60A0"
            },
            {
              "criteria": "cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "288B1E9C-52C3-4ACC-807D-F650B850D874"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}