CVE-2024-50688

CRITICAL

9.8

Descripcion

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for exchanging the device telemetry.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado2/26/2025

Ultima modificacion4/7/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

sungrowpower:isolarcloud

Debilidades (CWE)

CWE-798

Referencias

https://en.sungrowpower.com/security-notice-detail-2/6122(cve@mitre.org)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.