CVE-2017-9859
CriticalSummary
An issue was discovered in SMA Solar Technology products related to the use of a weak hashing algorithm for encrypting passwords in REGISTER requests. This algorithm can be cracked relatively easily, allowing an attacker to gain access to passwords.
Risk Assessment
An attacker could use the cracked password to register at SMA servers, posing a risk of unauthorized access to systems. Although the vendor considers the probability of success for such manipulation to be extremely low, the risk still exists.
Recommendation
It is recommended to update the software to the latest version and implement stronger password protection methods. Additionally, monitoring systems for unauthorized registration attempts should be conducted.
Original NVD description (English source)
An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline crackers. This cracked password can then be used to register at the SMA servers. NOTE: the vendor's position is that "we consider the probability of the success of such manipulation to be extremely low." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected