by Kastro
Paper/Archive/CVE-2024-0851

CVE-2024-0851

Grup Arge Energy and Control Systems Smartpower — SQLi in Grup Arge Energy and Control Systems's Smartpower

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 34.3.343 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQL Injection. This issue affects Smartpower: through V24.05.27.

Affected

ProductAffectedFixed inSource
Smartpower≤ V24.05.27–CNA
smartpower≤ 24.05.27–CISA-ADP

Scores by source

TR-CERT (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-24-0556refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0556