CVE-2017-5146

published 2017-02-13

CVE-2017-5146: An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is…

Priority P3 57 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text.

Detection & IOCs extracted from sources · hover to see the quote

path EWplant.db↗

• → Unauthenticated HTTP access to the EWplant.db database file on Carlo Gavazzi VMU-C devices is a strong indicator of exploitation of the access control flaw (CVE-2017-5144) which also enables the CVE-2017-5146 cleartext information exposure. ↗
• → Monitor for unauthenticated retrieval of SMTP configuration from Carlo Gavazzi VMU-C devices; older firmware versions expose SMTP config (including cleartext passwords) without any authentication. ↗
• → Scan/brute-force activity against Carlo Gavazzi Energy Meter login portals may precede credential harvesting and cleartext SMTP password extraction. ↗

• · CVE-2017-5146 (cleartext sensitive information) affects only VMU-C EM prior to firmware Version A11_U05 and VMU-C PV prior to firmware Version A17; patched versions are not vulnerable. ↗
• · A valid, admin-privileged user is normally required to extract the SMTP password, but some older firmware versions expose it without any authentication, widening the attack surface for cleartext credential exposure. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200