PT-2025-2885 · Sungrow · Sungrow Winet-Sv200

Published 2025-01-24 · Updated 2025-04-15 · CVE-2024-50694

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SunGrow WiNet-SV200 versions 0.001.00.P027 and earlier

Description The issue arises when copying the timestamp read from an MQTT message, as the underlying code does not check the bounds of the buffer used to store the message. This may lead to a stack-based buffer overflow.

Recommendations For SunGrow WiNet-SV200 versions 0.001.00.P027 and earlier, as a temporary workaround, consider restricting the use of MQTT message handling until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-50694

Affected Products

Sungrow Winet-Sv200

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-50694 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50694 · Vendor Advisory
• https://en.sungrowpower.com/security-notice-detail-2/5961 · Vendor Advisory
• https://twitter.com/syedaquib77/status/1912219638714503674 · Twitter Post
• https://t.me/cvenotify/108584 · Telegram Post
• https://twitter.com/CVEnew/status/1882994418871083468 · Twitter Post
• https://t.me/cvedetector/16349 · Telegram Post