Locus Energy updated its firmware to mitigate a command injection vulnerability in its LGate application, according to a report with ICS-CERT.
This vulnerability, discovered by independent researcher Daniel Reich, is remotely exploitable.
The following LGate versions suffer from the issue:
• LGate Version prior to 1.05H
• LGate 50
• LGate 100
• LGate 101
• LGate 120
• LGate 320
The vulnerability could allow an attacker to take control of LGate that has its web server port publicly exposed.
Locus Energy is a U.S.-based company. The affected product, LGate, is a web-based data acquisition system primarily used for Distributed PV Solar metering and data acquisition.
LGate sees action across the energy sector. Locus Energy said this product sees use primarily in North America.
Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information sent in the POST request.
CVE-2016-5782 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.6.
If the web server port ends up publicly exposed, this vulnerability is remotely exploitable.
No known public exploits specifically target this vulnerability. However, an attacker with a low skill would be able to exploit this vulnerability.
Locus Energy produced the following procedure to update LGate:
1. Cycle power to the LGate. This might require tripping one or more AC or DC breakers.
2. Power up the LGate and wait 5 minutes.
3. Use the web page on the LGate within the first half hour after power up to verify its firmware version.
3a. If connected to the local network, find the IP assigned to the LGate. Navigate to this IP using the browser on a computer also connected to the same subnet as the LGate.
3b. If the LGate is not connected to the local network, plug the Ethernet cable from the LGate into the computer. Wait until the computer settles into an AutoIP address in the 169.254.X.X range. Then use the IP 169.254.12.13 for the LGate. Use this IP in a browser to pull up the LGate web page.
4. The web page will display the model type, IP address, firmware version of the LGate (labeled as APP), and MAC address. Here is an example. In the picture below, the LGate (00:1E:C0:89:15:6E) is running 1.05C_EM3.
5. Verify that the firmware version is 1.05H_EM3 or above.
6. If the firmware version is less than 1.05H, send an email to Locus Energy with the subject line: URGENT FW UPDATE REQUEST: MAC:
7. Locus Energy support will attempt to remotely update the firmware on the LGate and confirm via email. If they encounter any difficulty in updating the LGate, Locus Energy will contact the user to arrange alternate methods to update or replace the LGate.
8. If support confirms that the unit was updated to Version 1.05H or later, the user may repeat the above procedure (Steps 1-5) to verify this.