CVE-2016-5782

highPriorität · verfolgen · 35EPSS 0.021 · 81. PerzentilEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
2.07% (81st) EPSS
CVSS 7.5 · high
Is it mine?
15 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information that is sent in the POST request.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

  • MitigationLGatecisa_csaf_ot

    Locus Energy has produced the following procedure to update LGate: 1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers. 2. Power up the LGate and wait 5 minutes. 3. Use the web page on the LGate within the first half hour after power up to verify its firmware version. 3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate. 3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page. 4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3. 5. Verify that the firmware version is 1.05H_EM3 or above. 6. If the firmware version is less than 1.05H, send an email to (support@locusenergy.com) with the subject line: URGENT FW UPDATE REQUEST: MAC: <insert MAC address here> TO 1.05H or higher FW. 7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate. 8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.

  • MitigationLGate 100cisa_csaf_ot

    Locus Energy has produced the following procedure to update LGate: 1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers. 2. Power up the LGate and wait 5 minutes. 3. Use the web page on the LGate within the first half hour after power up to verify its firmware version. 3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate. 3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page. 4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3. 5. Verify that the firmware version is 1.05H_EM3 or above. 6. If the firmware version is less than 1.05H, send an email to (support@locusenergy.com) with the subject line: URGENT FW UPDATE REQUEST: MAC: <insert MAC address here> TO 1.05H or higher FW. 7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate. 8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.

  • MitigationLGate 101cisa_csaf_ot

    Locus Energy has produced the following procedure to update LGate: 1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers. 2. Power up the LGate and wait 5 minutes. 3. Use the web page on the LGate within the first half hour after power up to verify its firmware version. 3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate. 3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page. 4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3. 5. Verify that the firmware version is 1.05H_EM3 or above. 6. If the firmware version is less than 1.05H, send an email to (support@locusenergy.com) with the subject line: URGENT FW UPDATE REQUEST: MAC: <insert MAC address here> TO 1.05H or higher FW. 7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate. 8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.

  • MitigationLGate 120cisa_csaf_ot

    Locus Energy has produced the following procedure to update LGate: 1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers. 2. Power up the LGate and wait 5 minutes. 3. Use the web page on the LGate within the first half hour after power up to verify its firmware version. 3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate. 3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page. 4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3. 5. Verify that the firmware version is 1.05H_EM3 or above. 6. If the firmware version is less than 1.05H, send an email to (support@locusenergy.com) with the subject line: URGENT FW UPDATE REQUEST: MAC: <insert MAC address here> TO 1.05H or higher FW. 7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate. 8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.

  • MitigationLGate 320cisa_csaf_ot

    Locus Energy has produced the following procedure to update LGate: 1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers. 2. Power up the LGate and wait 5 minutes. 3. Use the web page on the LGate within the first half hour after power up to verify its firmware version. 3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate. 3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page. 4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3. 5. Verify that the firmware version is 1.05H_EM3 or above. 6. If the firmware version is less than 1.05H, send an email to (support@locusenergy.com) with the subject line: URGENT FW UPDATE REQUEST: MAC: <insert MAC address here> TO 1.05H or higher FW. 7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate. 8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.

  • MitigationLGate 50cisa_csaf_ot

    Locus Energy has produced the following procedure to update LGate: 1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers. 2. Power up the LGate and wait 5 minutes. 3. Use the web page on the LGate within the first half hour after power up to verify its firmware version. 3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate. 3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page. 4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3. 5. Verify that the firmware version is 1.05H_EM3 or above. 6. If the firmware version is less than 1.05H, send an email to (support@locusenergy.com) with the subject line: URGENT FW UPDATE REQUEST: MAC: <insert MAC address here> TO 1.05H or higher FW. 7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate. 8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.

  • MitigationNovaWeb web HMIcisa_csaf_ot

    Sauter has not produced a mitigation for this vulnerability. This product was discontinued in 2013 and is no longer supported.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.6
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4
v3.08.6highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Lprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 4.7
v3.08.6highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Lsecondary · CISA US
v3.07.9highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USprimärCWE-78USCWE-784US
04

betroffene Produkte (15)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-16-231-01-0Locus Energy LGate Command Injection Vulnerability2016-05-22icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

  • ICSA-16-343-02Sauter NovaWeb Web HMI Authentication Bypass Vulnerability2016-09-11icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otnvdNVDCVE.orgMITRE
veröffentlicht 2017-02-13geändert 2026-06-17
09

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan