CVE-2017-9858
HighSummary
An issue was discovered in SMA Solar Technology products that allows determining active and inactive user accounts by sending crafted packets to an inverter and observing the response. This aids in further attacks, such as brute force attacks, as the attacker gains knowledge of existing users.
Risk Assessment
The organization may be exposed to attacks that exploit the disclosed user account information, potentially leading to unauthorized access to systems.
Recommendation
It is recommended to monitor and secure systems against potential attacks, as well as consider updating or replacing vulnerable inverters.
Other vulnerabilities in Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, TL-30
See all- CVE-2017-9864High
An issue was discovered in SMA Solar Technology products that allows an attacker to change the system time without any authentication. This can affect lockout policies and random-number generators based on timestamps.
- CVE-2017-9862High
An issue was discovered in SMA Solar Technology products that allows the creation of a debug report when signed into Sunny Explorer with a wrong password. This enables an attacker to disclose information regarding the application and save a .txt file with arbitrary content.
Original NVD description (English source)
An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks (such as a brute force attack) as one now knows exactly which users exist and which do not. NOTE: the vendor's position is that this "is not a security gap per se." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected