CVE-2019-19228 - Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file

Back Back to CVE browser

CRITICAL

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file

Published Dec 4, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.90%

Description

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-312

References (4)

http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8854
Advisory
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/
x_refsource_MISCExploitThird Party Advisory
https://seclists.org/bugtraq/2019/Dec/5
x_refsource_MISCExploitMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8854		Advisory
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/		x_refsource_MISCExploitThird Party Advisory
https://seclists.org/bugtraq/2019/Dec/5		x_refsource_MISCExploitMailing ListThird Party Advisory