TI-2012-04890 Aliases CVE-2012-5861 GHSA-f4r2-hvg9-43x3

Sinapsi eSolar SQL Injection

MEDIUM 41CWE-89Published 2012-11-23 · Updated 2025-07-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: Complete · None · None
Fix status: Fixed

Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

These Sinapsi devices do not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication within the device, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.

Why it matters now

EPSS 0.04239 91st percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA and NVD

Fix Fixed eSolar (Sinapsi): 2.0.2870_xxx_2.2.12eSolar DUO (Sinapsi): 2.0.2870_xxx_2.2.12+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sinapsi	eSolar	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar DUO	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar Light	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA

eSolar VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar DUO VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar Light VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:sinapsitech:sinapsi_firmware::::::::	up to 2.0.2870	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech

cpe:2.3:o:sinapsitech:sinapsi_firmware:*:*:*:*:*:*:*:* Versions up to 2.0.2870 Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech

Remediation

Fix · CNA eSolar (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar DUO (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar Light (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2012-11-23
Sinapsi eSolar, eSolar DUO, eSolar Light 2.0.2870_xxx_2.2.12
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2012-04892 Sinapsi eSolar OS Command InjectionPriority MEDIUM 64
- TI-2012-04891 Sinapsi eSolar Hard-Coded PasswordPriority MEDIUM 57
- TI-2012-04893 Sinapsi eSolar Improper AuthenticationPriority MEDIUM 51
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2012-5861
2026-10-03 Alias added: GHSA-f4r2-hvg9-43x3

References

Exploit 2

Other 2

TI-2012-04892 Sinapsi eSolar OS Command Injection CVSS 2.0CRITICAL 10.0
TI-2012-04891 Sinapsi eSolar Hard-Coded Password CVSS 2.0CRITICAL 10.0
TI-2012-04893 Sinapsi eSolar Improper Authentication CVSS 2.0HIGH 10.0
TI-2015-03335 Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences