CVE-2016-5782

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information that is sent in the POST request.

Metrics

CVSS 3.0 8.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Locus Energy LGate through 320	Locus Energy LGate through 320

References

http://www.securityfocus.com/bid/94698Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/94782Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01-0Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/94698Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/94782Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01-0Third Party Advisory, US Government Resource

Timeline

Published: Feb 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-57867.5An issue was discovered in OmniMetrix OmniView, Version 1.2. The OmniView web application transmits credentials with the HTTP protocol, whic CVE-2016-57876.3General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify CVE-2016-578810.0General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it CVE-2016-57898.0A Cross-site Request Forgery issue was discovered in JanTek JTC-200, all versions. An attacker could perform actions with the same permissio CVE-2016-57907.5Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vector CVE-2016-57919.8An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented B CVE-2016-57929.8SQL injection vulnerability in Moxa SoftCMS before 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields.CVE-2016-57938.8Unquoted Windows search path vulnerability in Moxa Active OPC Server before 2.4.19 allows local users to gain privileges via a Trojan horse CVE-2016-57957.3An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and pri CVE-2016-57968.8An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0. Sending additional v CVE-2016-57975.3Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the us CVE-2016-57987.5An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0. By sending additiona