PT-2025-35584 · Sunpower · Sunpower Pvs6

Dagan Henderson · Published 2025-09-02 · Updated 2025-09-03 · CVE-2025-9696

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions SunPower PVS6 (affected versions not specified)

Description The SunPower PVS6’s BluetoothLE interface is vulnerable due to the use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could gain full access to the device’s servicing interface. This access allows actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices. A real-world incident has been reported where a user discovered the vulnerability and was able to identify the potential to shutdown power production.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-9696

Affected Products

Sunpower Pvs6

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-9696 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-245-03 · Note
• https://twitter.com/the_yellow_fall/status/1963035852004852208 · Twitter Post
• https://reddit.com/r/solar/comments/1n6plpk/sunpower_residential_solar_vulnerable_to_wireless · Reddit Post
• https://twitter.com/zoomeye_team/status/1963083832963563801 · Twitter Post
• https://twitter.com/CVEnew/status/1962920228733456809 · Twitter Post
• https://twitter.com/fridaysecurity/status/1963036299088298292 · Twitter Post
• https://reddit.com/r/SunPower/comments/1n6pjxl/critical_vulnerability_in_sunpower_systems · Reddit Post
• https://t.me/pentestingnews/67404 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1962965050328539224 · Twitter Post