PT-2017-19221 · Sma Solar Technology · Sma Solar Technology Products+2

Willem Westerhof · Published 2017-08-05 · Updated 2024-10-29 · CVE-2017-9855

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SMA Solar Technology products (affected versions not specified) Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30

Description An issue was discovered in SMA Solar Technology products, related to the Grid Guard system, which is a secondary system available for Installers. This system uses predictable codes, and a single Grid Guard code can be used on any SMA inverter. When combined with the installer account, any such code allows changing very sensitive parameters. The vendor reports that Grid Guard is not an authentication feature, but only a tracing feature.

Recommendations For Sunny Boy TLST-21 and TL-21, consider restricting access to the Grid Guard system until a fix is available. For Sunny Boy TL-21, restrict access to the Grid Guard system until a fix is available. For Sunny Tripower TL-10 and TL-30, restrict access to the Grid Guard system until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2017-9855

Affected Products

Sma Solar Technology Products

Sunny Boy

Sunny Tripower

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-9855 · Security Note
• https://t.me/cvenotify/81984 · Telegram Post
• http://sma.de/en/statement-on-cyber-security.html · Note
• http://sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf · Note
• https://horusscenario.com/CVE-information · Note
• https://t.me/cvenotify/89266 · Telegram Post