PT-2025-32228 · Tigo Energy · Tigo Energy Cca

Anthony Rose + 2 · Published 2025-08-05 · Updated 2025-08-06 · CVE-2025-7770

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tigo Energy CCA device (affected versions not specified)

Description The Tigo Energy CCA device is susceptible to insecure session ID generation within its remote API. Session IDs are created using a predictable method based on the current timestamp, potentially allowing attackers to recreate valid session IDs. This, combined with the ability to bypass session ID requirements for specific commands, could grant unauthorized access to sensitive device functions on connected solar optimization systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-337

Related Identifiers

BDU:2025-09578

CVE-2025-7770

Affected Products

Tigo Energy Cca

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-7770 · Security Note
• https://bdu.fstec.ru/vul/2025-09578 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-217-02 · Note
• https://twitter.com/CveFindCom/status/1953202071131349042 · Twitter Post
• https://tigoenergy.com/product/cloud-connect-advanced · Note
• https://twitter.com/CVEnew/status/1953199067527368959 · Twitter Post
• https://t.me/CVEtracker/29401 · Telegram Post