Solar-Log Firmware Vulnerabilities: Unauth Config Download, CSRF, Arbitrary File Upload

Critical Vulnerability Information Vulnerability Overview Type: Multiple vulnerabilities Product: Solare Datensysteme GmbH - Solar-Log Affected Versions: Firmware 2.8.4-56 / 3.5.2-85 Fixed Version: Firmware 3.5.3-86 CVE ID: Not assigned Impact: - Unauthorized configuration download (including device password) - Cross-Site Request Forgery (CSRF) - Unauthorized arbitrary file upload - Information disclosure - Unauthorized network configuration changes - Unauthorized service denial - Potential unauthorized IPC@CHIP Flash reprogramming Vulnerability Details 1. Unauthorized Configuration Download (Including Device Password) Description: Attackers can download configuration files without authentication and extract passwords used to log into the Solar-Log device. Impact: Attackers gain administrative access to the device. 2. Cross-Site Request Forgery (CSRF) Description: Attackers can trick authenticated users into clicking specially crafted links to delete or modify device passwords. Impact: Attackers can take over the device. 3. Unauthorized Arbitrary File Upload Description: Attackers can upload arbitrary files using specially crafted POST requests. Impact: Attackers can store any malicious content on the Solar-Log device. 4. Information Disclosure (CVE-2001-1341) Description: All Solar-Log devices running the current firmware versions are affected by an information disclosure vulnerability. Impact: Internal network configuration, gateway, and device MAC address information are exposed. 5. Unauthorized Network Configuration Changes Description: Due to the default-enabled UDP configuration server on the Beck IPC chip, attackers can change IP configurations via specific UDP ports without authentication. Impact: Attackers can reconfigure the device without authentication. 6. Unauthorized Service Denial Description: Sending UDP packets with arbitrary null characters to the Beck IPC UDP configuration server can permanently disable the Solar-Log device until manually rebooted. Impact: Severe service disruption. 7. Potential Unauthorized IPC@CHIP Flash Reprogramming Description: Using the "CHIP TOOL" may allow attackers to reprogram the chip over the network without authentication. Impact: Could lead to simple DoS or complex botnet attacks on Solar-Log devices. Remediation Firmware Upgrade: Upgrade to version 3.5.3-86: Firmware Download Link Temporary Mitigation: Restrict network access to the device. Proof of Concept Exploit code and example requests are provided.

Goal Reached Thanks to every supporter — we hit 100%!

Solar-Log Firmware Vulnerabilities: Unauth Config Download, CSRF, Arbitrary File Upload

More from this source