CVE-2019-19229
Medium
Description
admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.
SeverityMedium
CVSS6.5
Exploit probability—
ProductFronius Datamanager Box 2.0 Firmware
PublishedDec 4, 2019
First seenDec 4, 2019
How to fix
Update
- fronius datamanager_box_2.0_firmware3.14.1 or later
- fronius eco_25.0-3-s_firmware3.14.1 or later
- fronius eco_27.0-3-s_firmware3.14.1 or later
- fronius galvo_1.5-1_firmware3.14.1 or later
- fronius galvo_1.5-1_208-240_firmware3.14.1 or later
- fronius galvo_2.0-1_firmware3.14.1 or later
- fronius galvo_2.0-1_208-240_firmware3.14.1 or later
- fronius galvo_2.5-1_firmware3.14.1 or later
- fronius galvo_2.5-1_208-240_firmware3.14.1 or later
- fronius galvo_3.0-1_firmware3.14.1 or later
- fronius galvo_3.1-1_firmware3.14.1 or later
- fronius galvo_3.1-1_208-240_firmware3.14.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fronius datamanager_box_2.0_firmware | v < 3.14.1 | 3.14.1 |
| fronius eco_25.0-3-s_firmware | v < 3.14.1 | 3.14.1 |
| fronius eco_27.0-3-s_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_1.5-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_1.5-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_2.0-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_2.0-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_2.5-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_2.5-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_3.0-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_3.1-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius galvo_3.1-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_10.0-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_11.4-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_12.5-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_15.0-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_3.0-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_3.5-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_3.6-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_3.8-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_4.0-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_4.6-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_5.0-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_5.0-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_5.0-1_aus_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_5.0-1_sc_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_6.0-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_6.0-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_7.6-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_8.2-1_firmware | v < 3.14.1 | 3.14.1 |
| fronius primo_8.2-1_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_10.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_10.0-3-m-os_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_10.0-3_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_10.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_12.0-3_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_12.5-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_12.5-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_15.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_15.0-3_107_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_15.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_17.5-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_17.5-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_20.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_20.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_22.7-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_24.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_3.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_3.0-3-s_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_3.7-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_3.7-3-s_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_4.5-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_4.5-3-s_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_5.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_6.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_7.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_8.2-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_advanced_10.0-3_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_advanced_12.0-3_208-240_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_advanced_15.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_advanced_20.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_advanced_22.7-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_advanced_24.0-3_480_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_hybrid_3.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_hybrid_4.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
| fronius symo_hybrid_5.0-3-m_firmware | v < 3.14.1 | 3.14.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.