CVE-2016-5782 : An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 10

An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information that is sent in the POST request.

Published 2017-02-13 21:59:00

Updated 2017-03-14 19:17:45

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2016-5782

Locusenergy » Lgate Firmware » Version: N/A
cpe:2.3:o:locusenergy:lgate_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Locusenergy » Lgate 100 » Version: N/A
When used together with: Locusenergy » Lgate 101 » Version: N/A
When used together with: Locusenergy » Lgate 120 » Version: N/A
When used together with: Locusenergy » Lgate 320 » Version: N/A
When used together with: Locusenergy » Lgate 50 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2016-5782

EPSS FAQ

0.88%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-5782

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	3.9	4.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: Low

CWE ids for CVE-2016-5782

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-5782

http://www.securityfocus.com/bid/94698

Multple Locus Energy LGate products Products CVE-2016-5782 Command Injection Vulnerability
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/94782

Sauter NovaWeb Web HMI CVE-2016-10224 Authentication Bypass Vulnerability
VDB Entry;Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01-0

Locus Energy LGate Command Injection Vulnerability | CISA
Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2016-5782

Products affected by CVE-2016-5782

Exploit prediction scoring system (EPSS) score for CVE-2016-5782

CVSS scores for CVE-2016-5782

CWE ids for CVE-2016-5782

References for CVE-2016-5782