TI-2012-04892 Aliases CVE-2012-5863 GHSA-44xp-g462-97fp

Sinapsi eSolar OS Command Injection

MEDIUM 64CWE-78Published 2012-11-23 · Updated 2025-07-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Code execution, Security bypass
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: Fixed

Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-78 and CWE-264.

Summary

These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, unexpected, or dangerous commands directly onto the operating system.

Why it matters now

EPSS 0.24823 97th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA and NVD

Fix Fixed eSolar (Sinapsi): 2.0.2870_xxx_2.2.12eSolar DUO (Sinapsi): 2.0.2870_xxx_2.2.12+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sinapsi	eSolar	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar DUO	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar Light	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA

eSolar VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar DUO VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar Light VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:sinapsitech:sinapsi_firmware::::::::	up to 2.0.2870	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech

cpe:2.3:o:sinapsitech:sinapsi_firmware:*:*:*:*:*:*:*:* Versions up to 2.0.2870 Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech

Remediation

Fix · CNA eSolar (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar DUO (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar Light (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2012-11-23
Sinapsi eSolar, eSolar DUO, eSolar Light 2.0.2870_xxx_2.2.12
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2012-04891 Sinapsi eSolar Hard-Coded PasswordPriority MEDIUM 57
- TI-2012-04893 Sinapsi eSolar Improper AuthenticationPriority MEDIUM 51
- TI-2012-04890 Sinapsi eSolar SQL InjectionPriority MEDIUM 41
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2012-5863
2026-10-03 Alias added: GHSA-44xp-g462-97fp

References

Exploit 2

Other 2

TI-2012-04891 Sinapsi eSolar Hard-Coded Password CVSS 2.0CRITICAL 10.0
TI-2012-04893 Sinapsi eSolar Improper Authentication CVSS 2.0HIGH 10.0
TI-2012-04890 Sinapsi eSolar SQL Injection CVSS 2.0HIGH 7.8
TI-2015-03335 Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences