What is the CVSS score of CVE-2025-15573?

CVE-2025-15573 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-15573?

Within 24 hours: Inventory all SolaX Cloud-connected devices and assess network exposure; escalate to device stakeholders and isolate critical systems if possible. Within 7 days: Implement network segmentation to restrict device communication to trusted networks only and enable monitoring for suspicious MQTT traffic patterns. Within 30 days: Contact SolaX for patch timeline; evaluate alternative cloud providers or on-premises solutions if patch availability is uncertain.

CVE-2025-15573

CRITICAL

Improper Certificate Validation (CWE-295)

2026-02-12 551230f0-3615-47bd-b7cc-93e92e730bbf

Authentication Bypass

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 11:15 nvd

CRITICAL 9.4

DescriptionCVE.org

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.

AnalysisAI

Missing certificate validation in SolaX solar inverter MQTT connections to Alibaba Cloud. Devices accept any server certificate, enabling MITM attacks on solar energy infrastructure.