TI-2012-04893 Aliases CVE-2012-5864 GHSA-v26h-2hg9-6mq7

Sinapsi eSolar Improper Authentication

MEDIUM 51CWE-287Published 2012-11-23 · Updated 2025-07-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.

Why it matters now

EPSS 0.04905 92nd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA and NVD

Fix Fixed eSolar (Sinapsi): 2.0.2870_xxx_2.2.12eSolar DUO (Sinapsi): 2.0.2870_xxx_2.2.12+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sinapsi	eSolar	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar DUO	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA
Sinapsi	eSolar Light	before 2.0.2870_xxx_2.2.12	2.0.2870_xxx_2.2.12	Patch available	CNA

eSolar VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar DUO VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA
eSolar Light VendorSinapsi Affected before 2.0.2870_xxx_2.2.12 Fixed in 2.0.2870_xxx_2.2.12 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:sinapsitech:sinapsi_firmware::::::::	up to 2.0.2870	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:::::::*	not specified by NVD	Vulnerable	Sinapsitech

cpe:2.3:o:sinapsitech:sinapsi_firmware:*:*:*:*:*:*:*:* Versions up to 2.0.2870 Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_duo_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_light_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech
cpe:2.3:h:sinapsitech:esolar_photovoltaic_system_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sinapsitech

Remediation

Fix · CNA eSolar (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar DUO (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12
Fix · CNA eSolar Light (Sinapsi) Fixed in 2.0.2870_xxx_2.2.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2012-11-23
Sinapsi eSolar, eSolar DUO, eSolar Light 2.0.2870_xxx_2.2.12
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2012-04892 Sinapsi eSolar OS Command InjectionPriority MEDIUM 64
- TI-2012-04891 Sinapsi eSolar Hard-Coded PasswordPriority MEDIUM 57
- TI-2012-04890 Sinapsi eSolar SQL InjectionPriority MEDIUM 41
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2012-5864
2026-10-03 Alias added: GHSA-v26h-2hg9-6mq7

References

Exploit 2

Other 2

TI-2012-04892 Sinapsi eSolar OS Command Injection CVSS 2.0CRITICAL 10.0
TI-2012-04891 Sinapsi eSolar Hard-Coded Password CVSS 2.0CRITICAL 10.0
TI-2012-04890 Sinapsi eSolar SQL Injection CVSS 2.0HIGH 7.8
TI-2015-03335 Sinapsi eSolar Light with firmware before 2.0.3970_schsl_2.2.85 allows attackers to… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences