critical9.4Public exploit code
CVE-2016-2296
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to ob…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Meteocontrol WEB’log - Admin Password Disclosure (Metasploit)2016-05-17 · webapps · multiple
Impact
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Meteocontrol | Web\'Log Basic 100 | All versions |
| Meteocontrol | Web\'Log Light | All versions |
| Meteocontrol | Web\'Log Pro | All versions |
| Meteocontrol | Web\'Log Pro Unlimited | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2016/May/52
- https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01
- https://www.exploit-db.com/exploits/39822/
- http://seclists.org/fulldisclosure/2016/May/52
- https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01
- https://www.exploit-db.com/exploits/39822/