CVE-2017-9852
CriticalSummary
An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords are rarely changed, leading to user passwords almost always being default, and installer passwords often being similar across installations.
Risk Assessment
The organization is at risk of unauthorized access to devices, which can lead to serious security incidents. Users with hidden accounts may be particularly vulnerable to attacks as their passwords are fixed and unchangeable.
Recommendation
It is recommended to change default passwords to unique ones and conduct regular security audits to identify and secure hidden accounts. Additionally, monitoring and updating password management procedures is advisable.
Original NVD description (English source)
An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company (but are sometimes changed). Hidden user accounts have (at least in some cases, though more research is required to test this for all hidden user accounts) a fixed password for all devices; it can never be changed by a user. Other vulnerabilities exist that allow an attacker to get the passwords of these hidden user accounts. NOTE: the vendor reports that it has no influence on the allocation of passwords, and that global hardcoded master passwords do not exist. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected