TI-2012-04891 Aliases CVE-2012-5862 GHSA-8xw2-rf2c-8v7w

Sinapsi eSolar Hard-Coded Password

MEDIUM 57CWE-259Published 2012-11-23 · Updated 2025-07-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: Fixed

Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-259.

Summary

These Sinapsi devices store hard-coded passwords in the PHP file of the device. By using the hard-coded passwords in the device, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.

Why it matters now

EPSS 0.12079 96th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA and NVD

Fix Fixed eSolar (Sinapsi): 2.0.2870_xxx_2.2.12eSolar DUO (Sinapsi): 2.0.2870_xxx_2.2.12+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sinapsi	eSolar	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar DUO	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar Light	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA

eSolar VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar DUO VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar Light VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:sinapsitech:sinapsi_firmware::::::::	up to 2.0.2870	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech

cpe:2.3:o:sinapsitech:sinapsi_firmware:*:*:*:*:*:*:*:* Versions up to 2.0.2870 Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech

Remediation

Fix · CNA eSolar (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar DUO (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar Light (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2012-11-23
Sinapsi eSolar, eSolar DUO, eSolar Light 2.0.2870_xxx_2.2.12
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2012-04892 Sinapsi eSolar OS Command InjectionPriority MEDIUM 64
- TI-2012-04893 Sinapsi eSolar Improper AuthenticationPriority MEDIUM 51
- TI-2012-04890 Sinapsi eSolar SQL InjectionPriority MEDIUM 41
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2012-5862
2026-10-03 Alias added: GHSA-8xw2-rf2c-8v7w

References

Exploit 2

Other 2

TI-2012-04892 Sinapsi eSolar OS Command Injection CVSS 2.0CRITICAL 10.0
TI-2012-04893 Sinapsi eSolar Improper Authentication CVSS 2.0HIGH 10.0
TI-2012-04890 Sinapsi eSolar SQL Injection CVSS 2.0HIGH 7.8
TI-2015-03335 Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences