SenNet Data Logger and Electricity Meters CVE-2017-6048 Remote Command Injection Vulnerability

Bugtraq ID:	98417
Class:	Design Error
CVE:	CVE-2017-6048
Remote:	Yes
Local:	No
Published:	May 11 2017 12:00AM
Updated:	May 11 2017 12:00AM
Credit:	Karn Ganeshan
Vulnerable:	Satel Iberia SenNet Solar Datalogger 5.03-1.56a Satel Iberia SenNet Optimal DataLogger 5.37c-1.43c Satel Iberia SenNet Multitask Meter 5.21a-1.18b
Not Vulnerable:

SenNet Data Logger and Electricity Meters CVE-2017-6048 Remote Command Injection Vulnerability

SenNet Data Logger and Electricity Meters are prone to a remote command-injection vulnerability.

Successful exploit allows an attacker to execute arbitrary commands in the context of the affected devices.

The following products and versions are vulnerable:

SenNet Optimal DataLogger 5.37c-1.43c and prior
SenNet Solar Datalogger 5.03-1.56a and prior
SenNet Multitask Meter 5.21a-1.18b and prior

SenNet Data Logger and Electricity Meters CVE-2017-6048 Remote Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SenNet Data Logger and Electricity Meters CVE-2017-6048 Remote Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SenNet Data Logger and Electricity Meters CVE-2017-6048 Remote Command Injection Vulnerability

References:

• SenNet Dataloggers Product Page (SenNet)
  
• ICSA-17-131-02 Satel Iberia SenNet Data Logger and Electricity Meters (CERT)
  
• SenNet Electricity Meters Product Page (SenNet)