CVE-2017-9853
CriticalSummary
An issue was discovered in SMA Solar Technology products related to a very weak password policy for user and installer passwords. There are no complexity or length requirements, making it difficult to create strong passwords.
Risk Assessment
The weak password policy may lead to unauthorized access to devices, posing a serious threat to the security of energy systems.
Recommendation
It is recommended to implement stronger password requirements, including minimum length and complexity, to enhance device security.
Original NVD description (English source)
An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of characters. NOTE: the vendor reports that the 12-character limit provides "a very high security standard." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected