PT-2025-25185 · Sungrow · Isolarcloud

Encs + 1 · Published 2025-06-11 · Updated 2025-06-11 · CVE-2025-29756

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y

Name of the Vulnerable Software and Affected Versions SunGrow's back end users system iSolarCloud (affected versions not specified)

Description The issue concerns the MQTT service used by iSolarCloud to transport data from connected devices to the user's web browser. The MQTT server lacks sufficient restrictions on topic subscriptions, allowing unauthorized access to data. Although the data is encrypted and MQTT credentials are obtained through an API call, an attacker can extract these credentials and the decryption key from the browser. This enables the attacker to subscribe to any topic, including the '#' topic, which would allow them to receive all messages from all connected devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-29756

Affected Products

Isolarcloud

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-29756 · Security Note
• https://t.me/cvetracker/26007 · Telegram Post
• https://isolarcloud.com · Note
• https://csirt.divd.nl/CVE-2025-29756 · Note
• https://twitter.com/CveFindCom/status/1932711975479292058 · Twitter Post
• https://twitter.com/CVEnew/status/1932721820324540880 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1932756029097324690 · Twitter Post
• https://t.me/cvenotify/125361 · Telegram Post
• https://t.me/latest_high_impact_cve/2606 · Telegram Post
• https://t.me/latest_high_impact_cve/2605 · Telegram Post
• https://csirt.divd.nl/DIVD-2025-00009 · Note