CVE-2017-9860
CriticalSummary
An issue was discovered in SMA Solar Technology products that allows an attacker to update device firmware without authentication using the SMAdata2+ protocol or Sunny Explorer. If an attacker creates a custom firmware version accepted by the inverter, it can be completely compromised.
Risk Assessment
An attacker can gain full access to the device's operating system, posing a risk of creating a botnet and using inverters as entry points into corporate networks.
Recommendation
It is recommended to monitor and secure devices against unauthorized firmware updates and implement additional protective measures to minimize risk.
Original NVD description (English source)
An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to authenticate. If an attacker is able to create a custom firmware version that is accepted by the inverter, the inverter is compromised completely. This allows the attacker to do nearly anything: for example, giving access to the local OS, creating a botnet, using the inverters as a stepping stone into companies, etc. NOTE: the vendor reports that this attack has always been blocked by "a final integrity and compatibility check." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected