BugTraq
SEC Consult SA-20161114-0 :: Multiple vulnerabilities in I-Panda SolarEagle - Solar Controller Administration Software / MPPT Solar Controller SMART2 Nov 14 2016 10:02AM
SEC Consult Vulnerability Lab (research sec-consult com)
SEC Consult Vulnerability Lab Security Advisory < 20161114-0 >
=======================================================================
title: Multiple vulnerabilities
product: I-Panda SolarEagle - Solar Controller Administration
Software / MPPT Solar Controller SMART2
vulnerable version: SolarEagle V2.00 / MPPT Solar Controller SMART2
fixed version: -
CVE number: -
impact: Medium
homepage: http://www.solarcontroller-inverter.com/
found: 2016-09-03
by: T. Weber (Office Vienna)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"ShenZhen I-Panda Electronics Co. Ltd. is developing power supply devices
such as UPS, power adapter and power inverter and also equipment for solar
systems. This equipment produced by I-Panda comprises solar panels/
controllers/inverters and also solar generator systems."

Source: http://www.solarcontroller-inverter.com/about-us.html

Business recommendation:
------------------------
SEC Consult recommends not to use this product until a thorough security
review has been performed by security professionals and all identified
issues have been resolved.

Vulnerability overview/description:
-----------------------------------
1) Broken Local Admin Authentication in SolarEagle V2.00
Attackers which have access to the locally installed software are able to
bypass the administrative login and can control the MPPT Solar Controller.

2) Missing Server Side Authentication in MPPT Solar Controller SMART2
Attackers which have access to the local network can send their own commands
to the MPPT Solar Controller and are able to control the device this way.

3) Unencrypted Communication in MPPT Solar Controller SMART2
Eavesdropping the communication is possible since unencrypted TCP is used
for all packets which are transferred between the controller and SolarEagle.

4) Denial of Service in MPPT Solar Controller SMART2
Attackers are able to disrupt an active connection as long as they want.

Proof of concept:
-----------------
The vendor was not responsive, hence there is no fix available. The proof of
concept has been removed from this advisory.

Vulnerable / tested versions:
-----------------------------
SolarEagle V2.00 / MPPT Solar Controller SMART2

Vendor contact timeline:
------------------------
2016-09-12: Contacting vendor through email, sending responsible disclosure
policy, defining release deadline (10th November), asking for
encryption keys
2016-09-13: Contacting vendor through email, sending responsible disclosure
policy, defining release deadline (10th November), asking for
encryption keys
2016-09-13: Vendor: (Instant-Messenger) No encryption available. Offer to
send the advisory unencrypted; No Answer
2016-10-29: Offer to send the advisory unencrypted; No Answer
2016-11-03: Offer to send the advisory unencrypted; No Answer
2016-11-14: SEC Consult releases security advisory

Solution:
---------
There is no fix available from the vendor as they did not respond.

Workaround:
-----------
No workaround

Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF T. Weber / @2016

0? *?H?÷
 ?0?10
 `?He0? *?H?÷
 ? 0?¯0?? à#Ë?S?­anzTgk!0
 *?H?÷
 0o1 0 USE10U
 AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0
141222000000Z
200530104838Z0?1 0 UGB10UGreater Manchester10USalford10U
COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA0?"0
 *?H?÷
?0?
??±
ÚzSNpR¼V¦&·¸Ià?çQ«ñðZI£´?`¼zQB§y?¤"ßaN?Õv#
ÓJ¶ ?n¥=Ùº»þ¡?©.CRC|¯2PȦOZéØÏ?%?{?è0dæ¤øV?ý*$3?¬Dåi?£FKÂ3Ôé@?°±¬?@¹
µ?:?*S£Û= a<U?ÙNv%!)ú£|qvOîá_éûT?ÛÃ{5R·?Þ"=,0-1Y½R7°3i-CëúÖ¥ñ?wgQ?Ùî'ë¼¥8v?¤©
8ÿß?õ¬I¾Ê÷s?:2«??:=F:WtaP¾Æ@?Ëäâ?¢!£?0?0U#0?­½?z4´&÷
úÄ&Tï½à$ËT0U?ak?ᢠªOìgñ£÷´?Áì0Uÿ?0Uÿ0
ÿ0U%0++0U 
00U 0DU=0;09 7 5?3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
+)0'0%+0?http://ocsp.usertrust.com0
 *?H?÷
 ?*n¬UÁ:«?ÅØíÍUóªka+À #?Åfjo±õ´µw^aß}þ³¤??üû[jr
A¼ºÁXÕ&ÂêÕM?ûþ??ÏXã"c?Rø»6«}X¥Þ«;cåÚÕsïìàû{â£ÿðB#?ʶM>äK²¨-ÔØ»BKi
?Û¦74è{à¥?Ê:Ç?O?4n?eÐ?»©ÜÊÊ6ÑôüÂd)5¯Ö±§qÒC±>?ì?2Sôv?Ê?4¹,ÊæJØ?
Á?â?ûZBj#!éeÇõÕ»~ê?? bêÑ:,YÅ?3ò8?å¶ézyöJ&ú|?û?0?_0?G #äÆBýÖ=ªÑ?nKN.0
 *?H?÷
 0?1 0 UGB10UGreater Manchester10USalford10U
COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA0
160301000000Z
170301235959Z0?U1 0 UAT1
0 U270010UNiederoesterreich10U Wr. Neustadt10U Komarigasse 141.0,U
%SEC Consult Unternehmensberatung GmbH1I0GU @Issued through SEC Consult Unternehmensberatung GmbH E-PKI Manag10U Corporate Secure Email1&0$USEC Consult Vulnerability Lab1'0% *?H?÷
 research (at) sec-consult (dot) com0 [email concealed]?"0
 *?H?÷
?0?
?ª!å?J?ÿ̶à?d8Lþ5n.<À?î,ah%Â໐ÑRØDʵ?ü?HØÞ6k??»Äg| ĤYDÓÁ?õ?ƽ
¿O(?0'ª][þÍÿ?¡Á?l¤K,i?±t?©?Ý?Ò?å×嬾êæu?gæ(ãȁ??Ä*%§ñ3ò]?«{ÄÕÊ?
?0?¹??¾®O_N?;ô¡0?<¡?=ü¢?¤ûÙ~R¹ºìÛð?Æ=ÈLÇßhwRuï ðÚf§ñ6ß7õø
ç??VÔåZ¹Y# p;?oÆ@3LÓ'?EÂ+Bâ??µÄ½³f­Á ?ýMÁ]Ãräþ­£?à0?Ü0U#0??ak?ᢠªOìgñ£÷´?Áì0UÈ3­~
?¾á¼¤<"Ç©2²¦O0Uÿ 0 Uÿ00U%0++0FU ?0=0; +²10+0)+https://secure.comodo.net/CPS0]UV0T0R P
 N?Lhttp://crl.comodoca.com/COMODOSHA256ClientAuthenticationandSecureEma
ilCA.crl0+?0?0X+0?Lhttp://crt.comodoca.com/COMODOS
HA256ClientAuthenticationandSecureEmailCA.crt0$+0?http://ocsp.c
omodoca.com0#U0research (at) sec-consult (dot) com0 [email concealed]
 *?H?÷
 ?RÑá?:??¡áìa?4ÙcC~Þ?w1»_´¤¶s?kõ
¢»¿Ö;?·¦b?äÅhøÕ?!J+æ rK?Bå?Çÿ?!>?Ó6/?hTBwT?l¿¹ùÁ6¹0ß3gKß5¦ÐJ8
?}¸ÛÔ%Q N?lr#té?ÀhM¡P&'aì}Äãå£DÝ/ôV/­èÃÜ?:?öQu' %FaU?iKÚÙ?]G°õ9,ÑÒ?Vr¦NGÆ?0iæNR£ÂæKÌëìû?Â5?|eÁ\`é#mn\ë?0J?
4» £ Î?æSv¦¬}O"aÌc7¸¯®+ËzìÝ1?A0?=0°0?1 0 UGB10UGreater Manchester10USalford10U
COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA#äÆBýÖ=ªÑ?nKN.0
 `?He ?a0 *?H?÷
 1  *?H?÷
0 *?H?÷
 1
161114100220Z0/ *?H?÷
 1" é^~ÌØI20ì¿e©r?]Ę́'é?­Ô9z&@#NL0l *?H?÷
 1_0]0  `?He*0  `?He0
*?H?÷
0*?H?÷
?0
*?H?÷
@0+0
*?H?÷
(0Á +?71³0°0?1 0 UGB10UGreater Manchester10USalford10U
COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA#äÆBýÖ=ªÑ?nKN.0Ã *?H?÷
  1³ °0?1 0 UGB10UGreater Manchester10USalford10U
COMODO CA Limited1A0?U8COMODO SHA-256 Client Authentication and Secure Email CA#äÆBýÖ=ªÑ?nKN.0
 *?H?÷
?#rÂÛ-êÍ|R(C?äk??¿?ÊúæI}?Úöa©Â¼?¹ÿTÜ?écxÞQ?Íâýö<½v??i±äÕºLò
ïÄ03.¦öj{´.æ°ÑCzjÆì?»,+dcÂ÷=`Ù·î¨O rC!ëö°f'ÉÒûs2ªÖ4ø¶g?û¿rÒ3/
É]¯?TÉû?{þF«P¯ë>Ü¡&¿v_?ª?7Å7ÒsfF ??Gøĵjv®qwG
Z>
?å[W§?hOo%:
Ê fÃç¥û?q#?¿æËó<ù?w¢ÅÉ??ftäKôªl,N?w.Cï²·aó

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus