PT-2024-12514 · Solax · Solax Pocket Wifi

Published 2024-01-23 · Updated 2024-01-31 · CVE-2023-35837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolaX Pocket WiFi versions 3 through 3.001.02

Description An issue was discovered where authentication for the web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has a default password, equal to the registration ID of the device, which is also used as the WiFi SSID name. There is no routine in place to force a change to this password on first use or bring its default state to the attention of the user. Once authenticated, an attacker can reconfigure the device or upload new firmware, leading to potential Denial of Service, code execution, or Escalation of Privileges.

Recommendations For SolaX Pocket WiFi versions 3 through 3.001.02, consider changing the default administrative password to a unique and strong password to prevent unauthorized access. As a temporary workaround, restrict access to the web interface until a patch is available. Avoid using the default registration ID as the WiFi SSID name and administrative password.

Fix

Related Identifiers

CVE-2023-35837

Affected Products

Solax Pocket Wifi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-35837 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35837 · Vendor Advisory
• https://t.me/cvenotify/69392 · Telegram Post
• https://solaxpower.com/help/upgrading-the-pocket-wifi-firmware · Note
• https://yougottahackthat.com/blog · Note
• https://solaxpower.com/downloads · Note
• https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication · Note