Sunny Boy 3600 Firmware
CVE-2017-9858
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks (such as a brute force attack) as one now knows exactly which users exist and which do not. NOTE: the vendor's position is that this "is not a security gap per se." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
AnalysisAI
An issue was discovered in SMA Solar Technology products. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks (such as a brute force attack) as one now knows exactly which users exist and which do not. NOTE: the vendor's position is that this "is not a security gap per se." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected Affected products include: Sma Sunny Boy 3600 Firmware, Sma Sunny Boy 5000 Firmware, Sma Sunny Tripower Core1 Firmware, Sma Sunny Tripower 15000Tl Firmware, Sma Sunny Tripower 20000Tl Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
More in Sunny Boy 3600 Firmware
View allAn issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.8), this vulnerability is remo
An issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.8), this vulnerability is remo
An issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.8), this vulnerability is remo
An Incorrect Password Management issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.
An issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.8), this vulnerability is remo
An issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.8), this vulnerability is remo
An issue was discovered in SMA Solar Technology products. Rated critical severity (CVSS 9.8), this vulnerability is remo
An issue was discovered in SMA Solar Technology products. Rated high severity (CVSS 8.8), this vulnerability is remotely
An issue was discovered in SMA Solar Technology products. Rated high severity (CVSS 8.1), this vulnerability is remotely
An issue was discovered in SMA Solar Technology products. Rated high severity (CVSS 7.5), this vulnerability is remotely
An issue was discovered in SMA Solar Technology products. Rated low severity (CVSS 3.4), this vulnerability is remotely
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today