{"id":"CVE-2012-5863","aliases":["EUVD-2012-5741","GHSA-44xp-g462-97fp"],"status":"published","title":"Sinapsi eSolar OS Command Injection","description":"These Sinapsi devices do not check for special elements in commands sent \nto the system. By accessing certain pages with administrative privileges\n that do not require authentication within the device, attackers can \nexecute arbitrary, unexpected, or dangerous commands directly onto the \noperating system.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.24823,"percentile":0.97917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264","CWE-78"],"published":"2012-11-23T11:00:00Z","modified":"2026-06-16T23:47:28Z","exploits":[{"source":"exploitdb","id":"EDB-21273","title":"Ezylog Photovoltaic Management Server - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2012-09-12","url":"https://www.exploit-db.com/exploits/21273"}],"products":[{"vendor":"sinapsi","product":"esolar"},{"vendor":"sinapsi","product":"esolar duo"},{"vendor":"sinapsi","product":"esolar light"},{"vendor":"sinapsitech","product":"esolar_duo_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"esolar_light_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"esolar_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"sinapsi_firmware"}],"references":[{"url":"http://www.exploit-db.com/exploits/21273/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80200","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01"},{"url":"http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80202","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5863"},{"url":"http://www.exploit-db.com/exploits/21273"},{"url":"https://github.com/advisories/GHSA-44xp-g462-97fp"}],"sources":{"cve":[{"id":"CVE-2012-5863","title":"Sinapsi eSolar OS Command Injection","description":"These Sinapsi devices do not check for special elements in commands sent \nto the system. By accessing certain pages with administrative privileges\n that do not require authentication within the device, attackers can \nexecute arbitrary, unexpected, or dangerous commands directly onto the \noperating system.","status":"published","published":"2012-11-23T11:00:00Z","modified":"2025-07-08T15:25:08.554Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2012-5741","description":"These Sinapsi devices do not check for special elements in commands sent \nto the system. By accessing certain pages with administrative privileges\n that do not require authentication within the device, attackers can \nexecute arbitrary, unexpected, or dangerous commands directly onto the \noperating system.","status":"published","published":"2012-11-23T11:00:00Z","modified":"2025-07-08T15:25:08Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"critical"}],"updated_at":"2026-11-02T20:32:12.59227Z"}],"ghsa":[{"id":"GHSA-44xp-g462-97fp","title":"ping.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog...","description":"ping.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip_dominio parameter.","status":"published","published":"2022-05-17T01:38:31Z","modified":"2025-07-08T18:31:29Z","cwes":["CWE-78"],"updated_at":"2026-11-02T15:02:56.619633Z"}],"nvd":[{"id":"CVE-2012-5863","description":"These Sinapsi devices do not check for special elements in commands sent \nto the system. By accessing certain pages with administrative privileges\n that do not require authentication within the device, attackers can \nexecute arbitrary, unexpected, or dangerous commands directly onto the \noperating system.","status":"published","published":"2012-11-23T12:09:58.477Z","modified":"2026-06-16T23:47:28.923Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78","CWE-264"],"updated_at":"2026-11-02T14:02:16.536025Z"}]}}