Trusted Design

DTE Energy Insight app vulnerable to information exposure

概要

CWE-200: Information Exposure - CVE-2016-1562 The DTE Energy Insight app lets DTE Energy customers track their energy usage. This information is exposed via an HTTP REST API. The API contains a parameter 'filter' that may be manipulated by an authenticated user. This parameter determines the customer data to be returned by the server. By manipulating the 'filter' parameter, an authorized user may be able to obtain and query limited customer information for other users. The researcher has released a blog post with more details.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Microsoft OLE URL Moniker improperly handles remotely-linked HTA data (score: 0.39)
Microsoft Security Bulletin MS15-093 - Internet Explorer RCE (score: 0.38)
Exploring CVE-2015-2545 and its users (score: 0.38)
EVASIVE MANEUVERS BY THE WEKBY GROUP (score: 0.38)
DVR Firmware for multiple vendors contains hard-coded creds (score: 0.37)

このPulseに関連する脅威アクター (事実ベース)

APT32

Score: 9.54

Matched TTPs:

T1552.002 - Credentials in Registry
T1564.001 - Hidden Files and Directories
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

RedCurl

Score: 6.80

Matched TTPs:

T1552.002 - Credentials in Registry
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Earth Lusca

Score: 3.84

Matched TTPs:

T1098.004 - SSH Authorized Keys

MITREへのリンク →

Salt Typhoon

Score: 6.59

Matched TTPs:

T1098.004 - SSH Authorized Keys
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

TeamTNT

Score: 3.84

Matched TTPs:

T1098.004 - SSH Authorized Keys

MITREへのリンク →

APT12

Score: 4.54

Matched TTPs:

T1568.003 - DNS Calculation

MITREへのリンク →

Lazarus Group

Score: 13.39

Matched TTPs:

T1098 - Account Manipulation
T1027.007 - Dynamic API Resolution
T1564.001 - Hidden Files and Directories
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Scattered Spider

Score: 3.84

Matched TTPs:

T1098 - Account Manipulation

MITREへのリンク →

HAFNIUM

Score: 10.64

Matched TTPs:

T1098 - Account Manipulation
T1564.001 - Hidden Files and Directories
T1550.001 - Application Access Token

MITREへのリンク →

Gamaredon Group

Score: 4.54

Matched TTPs:

T1001 - Data Obfuscation

MITREへのリンク →

Gorgon Group

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

Threat Group-3390

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

Patchwork

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

BlackByte

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

TA2541

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

menuPass

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

Kimsuky

Score: 3.15

Matched TTPs:

T1055.012 - Process Hollowing

MITREへのリンク →

APT29

Score: 4.54

Matched TTPs:

T1090.004 - Domain Fronting

MITREへのリンク →

Mustard Tempest

Score: 4.54

Matched TTPs:

T1608.006 - SEO Poisoning

MITREへのリンク →

Mustang Panda

Score: 9.54

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1564.001 - Hidden Files and Directories
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

APT28

Score: 6.80

Matched TTPs:

T1564.001 - Hidden Files and Directories
T1550.001 - Application Access Token

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Lazarus Group

Score: 0.73

Matched TTPs:

T1564.001 - Hidden Files and Directories
T1027.007 - Dynamic API Resolution
T1098 - Account Manipulation
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

HAFNIUM

Score: 0.64

Matched TTPs:

T1564.001 - Hidden Files and Directories
T1098 - Account Manipulation
T1550.001 - Application Access Token

MITREへのリンク →

APT32

Score: 0.57

Matched TTPs:

T1552.002 - Credentials in Registry
T1564.001 - Hidden Files and Directories
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Mustang Panda

Score: 0.56

Matched TTPs:

T1564.001 - Hidden Files and Directories
T1027.007 - Dynamic API Resolution
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Related CVEs

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る