Vulnerability Description
admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fronius | Datamanager Box 2.0 Firmware | < 3.14.1 |
| Fronius | Datamanager Box 2.0 | - |
| Fronius | Eco 25.0-3-S Firmware | < 3.14.1 |
| Fronius | Eco 25.0-3-S | - |
| Fronius | Eco 27.0-3-S Firmware | < 3.14.1 |
| Fronius | Eco 27.0-3-S | - |
| Fronius | Galvo 1.5-1 Firmware | < 3.14.1 |
| Fronius | Galvo 1.5-1 | - |
| Fronius | Galvo 1.5-1 208-240 Firmware | < 3.14.1 |
| Fronius | Galvo 1.5-1 208-240 | - |
| Fronius | Galvo 2.0-1 Firmware | < 3.14.1 |
| Fronius | Galvo 2.0-1 | - |
| Fronius | Galvo 2.0-1 208-240 Firmware | < 3.14.1 |
| Fronius | Galvo 2.0-1 208-240 | - |
| Fronius | Galvo 2.5-1 Firmware | < 3.14.1 |
| Fronius | Galvo 2.5-1 | - |
| Fronius | Galvo 2.5-1 208-240 Firmware | < 3.14.1 |
| Fronius | Galvo 2.5-1 208-240 | - |
| Fronius | Galvo 3.0-1 Firmware | < 3.14.1 |
| Fronius | Galvo 3.0-1 | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-InsecuExploitThird Party AdvisoryVDB Entry
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-soExploitThird Party Advisory
- https://seclists.org/bugtraq/2019/Dec/5ExploitMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-InsecuExploitThird Party AdvisoryVDB Entry
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-soExploitThird Party Advisory
- https://seclists.org/bugtraq/2019/Dec/5ExploitMailing ListThird Party Advisory
FAQ
What is CVE-2019-19229?
CVE-2019-19229 is a vulnerability with a CVSS score of 6.5 (MEDIUM). admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.
How severe is CVE-2019-19229?
CVE-2019-19229 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-19229?
Check the references section above for vendor advisories and patch information. Affected products include: Fronius Datamanager Box 2.0 Firmware, Fronius Datamanager Box 2.0, Fronius Eco 25.0-3-S Firmware, Fronius Eco 25.0-3-S, Fronius Eco 27.0-3-S Firmware.