CVE-2021-34544
MEDIUMSolar-Log 500 < 2.8.2 - Cleartext Storage of Sensitive Information in Export and Notification Pages
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-34544. PoCs published by Luca.Chiou.
AI-analyzed exploit summary The exploit describes an information disclosure vulnerability in Solar-Log 500 devices where plaintext passwords for FTP, SMTP, and SMS services are exposed via specific HTML endpoints. The PoC involves accessing these endpoints to retrieve sensitive credentials.
Description
An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
Exploits (1)
The exploit describes an information disclosure vulnerability in Solar-Log 500 devices where plaintext passwords for FTP, SMTP, and SMS services are exposed via specific HTML endpoints. The PoC involves accessing these endpoints to retrieve sensitive credentials.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N