CVE-2012-5863

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

These Sinapsi devices do not check for special elements in commands sent to the system. By accessing certain pages with administrative privileges that do not require authentication within the device, attackers can execute arbitrary, unexpected, or dangerous commands directly onto the operating system.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-78 CWE-264

Affected software

Vendor	Product	Versions
Sinapsi	eSolar	< 2.0.2870_xxx_2.2.12
Sinapsi	eSolar DUO	< 2.0.2870_xxx_2.2.12
Sinapsi	eSolar Light	< 2.0.2870_xxx_2.2.12

References

Timeline

Published: Nov 23, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-586410.0These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages CVE-2012-58656.5SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the act CVE-2012-58664.3Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via CVE-2012-58679.8HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability CVE-2012-58682.6WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote a CVE-2012-58729.8ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SP CVE-2012-58736.1ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.CVE-2012-58747.5Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Elite Bulletin Board be CVE-2012-58755.0Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1) crafted Connection CVE-2012-58765.0Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of ser CVE-2012-58775.0Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP hea CVE-2012-58789.8Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacha