PT-2025-32227 · Tigo Energy · Tigo Energy Cca

Anthony Rose + 2 · Published 2025-08-05 · Updated 2025-08-07 · CVE-2025-7769

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tigo Energy CCA (affected versions not specified)

Description The Tigo Energy CCA is susceptible to a command injection issue in the /cgi-bin/mobile api endpoint when the DEVICE PING command is invoked. This allows for remote code execution due to inadequate handling of user input. Exploitation with default credentials could lead to unauthorized access, service disruption, and data exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-09579

CVE-2025-7769

Affected Products

Tigo Energy Cca

References · 9

• 🔥 https://exploit-db.com/exploits/52404 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7769 · Security Note
• https://bdu.fstec.ru/vul/2025-09579 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-217-02 · Note
• https://twitter.com/CveFindCom/status/1953202124340261045 · Twitter Post
• https://t.me/CVEtracker/29400 · Telegram Post
• https://tigoenergy.com/product/cloud-connect-advanced · Note
• https://twitter.com/byte_reaper/status/1953438308240937162 · Twitter Post
• https://twitter.com/CVEnew/status/1953199071004438551 · Twitter Post