PT-2017-19220 · Sma Solar Technology · Sma Solar Technology Products+3

Willem Westerhof · Published 2017-08-05 · Updated 2024-08-05 · CVE-2017-9854

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SMA Solar Technology products (affected versions not specified) Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30

Description An issue was discovered in SMA Solar Technology products where plaintext passwords can be obtained by sniffing for specific packets on the localhost as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. The vendor reports that the exploitation likelihood is low because these packets are usually sent only once during installation.

Recommendations For Sunny Boy versions TLST-21 and TL-21, consider restricting access to the device during installation to minimize the risk of exploitation. For Sunny Tripower versions TL-10 and TL-30, avoid using the device on unsecured networks until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2017-9854

Affected Products

Sma Solar Technology Products

Sunny Boy

Sunny Explorer

Sunny Tripower

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-9854 · Security Note
• http://sma.de/en/statement-on-cyber-security.html · Note
• http://sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf · Note
• https://t.me/cvenotify/89265 · Telegram Post
• https://horusscenario.com/CVE-information · Note