Sinapsi eSolar OS Command Injection
53Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 25%
from disclosure to weapon0 days
Published on NVDNov 23
1st PoCSep 12
exploitation probability
25%top 2% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
These Sinapsi devices do not check for special elements in commands sent
to the system. By accessing certain pages with administrative privileges
that do not require authentication within the device, attackers can
execute arbitrary, unexpected, or dangerous commands directly onto the
operating system.
AV:N/AC:L/Au:N/C:C/I:C/A:C
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/21273unverifiedcve_referencewww.exploit-db.com/exploits/21273/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/80200https://exchange.xforce.ibmcloud.com/vulnerabilities/80202https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01http://www.exploit-db.com/exploits/21273/http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf