PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25379 Ourenergy CVE debrief

CVE-2018-25379 documents a boolean-based blind SQL injection vulnerability in Collectric CMU 1.0, specifically within the `lang` parameter of the authentication interface. The vulnerability permits unauthenticated remote attackers to manipulate database queries during login, enabling extraction of sensitive information via time-based blind injection techniques. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) reflects network accessibility with low attack complexity, no privileges required, and high confidentiality impact. The vulnerability was published to CVE on 2026-05-25 and modified on 2026-05-26. The NVD entry currently carries a 'Deferred' status. Vendor attribution remains uncertain: the reference domain candidate 'Ourenergy' suggests possible vendor association, though confidence is low and the entry requires review. No Known Exploited Vulnerability (KEV) listing exists.

Vendor
Ourenergy
Product
Collectric CMU
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-24
Advisory published
2026-05-25
Advisory updated
2026-07-24

Who should care

Organizations operating Collectric CMU 1.0 installations; security teams monitoring legacy industrial control or energy management systems; database administrators responsible for application-layer access controls.

Technical summary

The vulnerability exists in the `lang` parameter of Collectric CMU 1.0's authentication mechanism. Attackers can inject SQL payloads without authentication, leveraging boolean-based blind techniques to infer database contents through timing differences. The injection point during login processing creates a direct path to sensitive data extraction without requiring error messages or verbose output.

Defensive priority

HIGH

Recommended defensive actions

  • Review authentication input validation for the `lang` parameter in Collectric CMU deployments
  • Implement parameterized queries or prepared statements for all database interactions
  • Apply principle of least privilege to database accounts used by the application
  • Monitor for anomalous login request patterns involving the `lang` parameter
  • Verify vendor attribution with Ourenergy domain contacts if product deployment confirmed
  • Await NVD status resolution from 'Deferred' to determine final severity assessment

Evidence notes

Primary evidence derives from NVD modified feed with VulnCheck as disclosure source. CVSS 4.0 vector supplied. CPE criteria absent from source. Vendor identification flagged for review due to low-confidence domain inference.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-25379 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-25379

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-25379 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-25379

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.