PT-2025-25185 · Sungrow · Isolarcloud

Encs + 1 · Publicado 2025-06-11 · Atualizado 2025-06-11 · CVE-2025-29756

Positive Technologies (AI Summary)

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y

Name of the Vulnerable Software and Affected Versions SunGrow's back end users system iSolarCloud (affected versions not specified)

Description The issue concerns the MQTT service used by iSolarCloud to transport data from connected devices to the user's web browser. The MQTT server lacks sufficient restrictions on topic subscriptions, allowing unauthorized access to data. Although the data is encrypted and MQTT credentials are obtained through an API call, an attacker can extract these credentials and the decryption key from the browser. This enables the attacker to subscribe to any topic, including the '#' topic, which would allow them to receive all messages from all connected devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-29756

Produtos afetados

Isolarcloud

Referências · 11

• https://t.me/cvetracker/26007 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-29756 · Nota de Segurança
• https://isolarcloud.com · Nota
• https://csirt.divd.nl/CVE-2025-29756 · Nota
• https://twitter.com/CveFindCom/status/1932711975479292058 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1932721820324540880 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1932756029097324690 · Publicação no Twitter
• https://t.me/cvenotify/125361 · Publicação no Telegram
• https://t.me/latest_high_impact_cve/2606 · Publicação no Telegram
• https://t.me/latest_high_impact_cve/2605 · Publicação no Telegram
• https://csirt.divd.nl/DIVD-2025-00009 · Nota