PT-2014-07: Sensitive Information Disclosure in Solar-Log
Firmware: all versions before 3.1.1-66
Severity level: Medium
Impact: Information Disclosure
Access Vector: Remote
Base Score: 5.0
CVE: not assigned
Solar-Log – is a component of a photoelectric control system intended to collect data, implement a remote diagnostics and system performance monitoring.
The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in Solar-Log.
CGI scripts used for backup and restore system data and configuration are not protected with password (even if local authentication is enabled) and could be accessed by an attacker.
How to fix
Update your firmware up to the latest version
11.04.2014 - Vendor gets vulnerability details
14.04.2014 - Vendor releases fixed version and details
05.05.2014 - Public disclosure
The vulnerability was detected by Artem Chaykin, Positive Research Center (Positive Technologies Company)
Reports on the vulnerabilities previously discovered by Positive Research: