PT-2025-8748 · Sungrow · Sungrow Winet-S

Published 2025-02-26 · Updated 2025-03-08 · CVE-2024-50696

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SunGrow WiNet-S versions V200.001.00.P025 and earlier

Description The issue is related to missing integrity checks for firmware upgrades. By sending a specific MQTT message, it is possible to update an inverter or a WiNet connectivity dongle with a bogus firmware file located on an attacker-controlled server.

Recommendations For SunGrow WiNet-S versions V200.001.00.P025 and earlier, consider implementing integrity checks for firmware upgrades to prevent the installation of bogus firmware files. As a temporary workaround, restrict access to the firmware update mechanism until a patch is available.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2024-50696

Affected Products

Sungrow Winet-S

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-50696 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50696 · Vendor Advisory
• https://en.sungrowpower.com/security-notice-detail-2/6140 · Vendor Advisory
• https://twitter.com/CVEnew/status/1898276775823827430 · Twitter Post
• https://t.me/cvedetector/18971 · Telegram Post