[0day-rubbish] Circutor LineEds 24.11.14-r0 unauthenticated pwrstudio events.xml shellExecute command injection (9.8)
Circutor LineEds 24.11.14-r0 has unauthenticated command injection in pwrstudio via events.xml shellExecute.
The 0day Rubbish Research Team disclosed an unauthenticated operating-system command injection in the pwrstudio daemon shipped with Circutor LineEds firmware 24.11.14-r0, engine variant pss0. The flaw, classified as CWE-78 and scored 9.8, is reached through an events.xml shellExecute path. Circutor S.A., based in Spain, places the gateway between metering and power-quality devices and an energy-management or SCADA back office. The post assigns no CVE and does not report exploitation in the wild.
- Unauthenticated CWE-78 command injection in pwrstudio, scored 9.8.
- Reached via events.xml shellExecute on LineEds 24.11.14-r0 (pss0).
- Appliance bridges metering gear and energy-management or SCADA systems.
- Circutor S.A. is Spanish; no CVE or exploitation is reported.
- Vendors
- Circutor
- Organizations
- 0day Rubbish Research Team
- Countries
- Spain
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in the pwrstudio daemon shipped in Circutor LineEds (Line Energy Data System) industrial energy gateway firmware 24. 11. 14-r0, engine variant pss0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.