PT-2017-19225 · Sma Solar Technology · Tl-30+3

Willem Westerhof · Published 2017-08-05 · Updated 2024-08-05 · CVE-2017-9859

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30 (affected versions not specified)

Description An issue was discovered in SMA Solar Technology products where the inverters use a weak hashing algorithm to encrypt passwords for REGISTER requests. This hashing algorithm can be cracked relatively easily, allowing an attacker to use offline crackers to obtain the password. The cracked password can then be used to register at the SMA servers.

Recommendations For Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30, consider changing the password regularly and using a strong password to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2017-9859

Affected Products

Sunny Boy Tlst-21

Sunny Tripower Tl-10

Tl-21

Tl-30

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-9859 · Security Note
• http://sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf · Note
• http://sma.de/en/statement-on-cyber-security.html · Note
• https://horusscenario.com/CVE-information · Note