CVE-2012-5863CWE-78

CVE-2012-5863: vulnerability in Sinapsi eSolar

Sinapsi eSolar OS Command Injection

Published · Updated

Follow this CVE+ Monitor eSolar+ Monitor eSolar DUO

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

53Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 10epss 25%
from disclosure to weaponsame day
Published on NVDNov 23
1st PoCSep 12
These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, unexpected, or dangerous commands directly onto the operating system.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected products
Sinapsi · eSolarSinapsi · eSolar DUOSinapsi · eSolar Light
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sinapsi eSolar

In the same product, most dangerous first.

CVE-2012-5862—Sinapsi eSolar Hard-Coded PasswordEPSS 12.1%CVE-2012-5864—Sinapsi eSolar Improper AuthenticationEPSS 4.9%CVE-2012-5861—Sinapsi eSolar SQL InjectionEPSS 4.2%