PT-2025-49142 · Unknown · Soliscloud Api

James Gallagher · Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-13932

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SolisCloud API (affected versions not specified)

Description The SolisCloud API has a Broken Access Control issue, specifically an Insecure Direct Object Reference (IDOR). An authenticated user can access detailed data for any plant by modifying the plant id in a request. The API endpoint is vulnerable to unauthorized access due to improper access control mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13932

Affected Products

Soliscloud Api

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13932 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-338-06 · Note
• https://twitter.com/syedaquib77/status/1996824323064246353 · Twitter Post
• https://twitter.com/CVEnew/status/1996698861377663464 · Twitter Post
• https://t.me/CVEtracker/38862 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-338-06https://cisa.gov/news-events/ics-advisories/icsa-25-338-06 · Note
• https://twitter.com/VulmonFeeds/status/1996810341490028614 · Twitter Post