PT-2025-6771 · Goodwe Technologies Co. · Gw1500‑Xs

Published 2025-02-14 · Updated 2025-02-15 · CVE-2024-8893

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GoodWe Technologies Co., Ltd. GW1500‑XS version 1.1.2.1

Description The issue affects GoodWe Technologies Co., Ltd. GW1500‑XS, allowing anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi due to the use of hard-coded credentials.

Recommendations For version 1.1.2.1, consider changing the default credentials to custom, secure ones as soon as possible to prevent unauthorized access. As a temporary workaround, restrict physical access to the device and its Wi‑Fi network to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-8893

Affected Products

Gw1500‑Xs

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-8893 · Security Note
• https://t.me/cvedetector/18131 · Telegram Post
• https://twitter.com/cybercronai/status/1890733227435782291 · Twitter Post
• https://twitter.com/CVEnew/status/1890455706311999733 · Twitter Post
• https://os-s.net/publications/advisories/CVE-2024-8893.pdf · Note