Network Security, Vulnerability Management

Flaw in solar energy app patched

A command injection vulnerability in Locus Energy's LGate application could be exploited remotely, according to an advisory (ICSA-16-231-01) from ISC-CERT.

The bug could enable miscreants to commandeer several LGate versions which have their web server port publicly exposed.

LGate gathers performance data from solar photovoltaic (PV) systems, primarily in the North American energy sector. A PHP script used in the company's meters manages "the energy meter parameters for voltage monitoring and network configuration," according to the advisory. "The PHP code does not properly validate information that is sent in the POST request."

While no known attacks have targeted this vulnerability, the flaw could be exploited by an "attacker with a low skill," the advisory said.

Locus Energy has issued a firmware update to patch the flaw.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.