PT-2026-7837 · Solax Power+1 · Solax Power Pocket Wifi+1

Published 2026-02-12 · Updated 2026-04-17 · CVE-2025-15575

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Solax Power Pocket WiFi (affected versions not specified)

Description The firmware update functionality lacks verification of the authenticity of supplied firmware update files. This allows attackers to flash malicious firmware updates onto the device. Initial analysis reveals the absence of cryptographic checks, such as digital signature checks, on the provided firmware update files. Additionally, ESP32 security features like secure boot are not utilized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-15575

Affected Products

Esp32

Solax Power Pocket Wifi

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-15575 · Security Note
• https://t.me/cveNotify/151817 · Telegram Post
• https://r.sec-consult.com/solax · Note
• https://reddit.com/r/IOT/comments/1snoiwx/my_thoughts_on_cyber_warfare_using_iot_devices · Reddit Post
• https://t.me/CVEtracker/44521 · Telegram Post