CVE-2017-9862
HighSummary
An issue was discovered in SMA Solar Technology products that allows the creation of a debug report when signed into Sunny Explorer with a wrong password. This enables an attacker to disclose information regarding the application and save a .txt file with arbitrary content.
Risk Assessment
An attacker may exploit this vulnerability for information disclosure or to write a file to normally unavailable locations on the local system, potentially leading to further attacks.
Recommendation
It is recommended to monitor access to Sunny Explorer and implement stronger authentication mechanisms to minimize the risk of unauthorized access.
Other vulnerabilities in Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, TL-30
See all- CVE-2017-9864High
An issue was discovered in SMA Solar Technology products that allows an attacker to change the system time without any authentication. This can affect lockout policies and random-number generators based on timestamps.
- CVE-2017-9858High
An issue was discovered in SMA Solar Technology products that allows determining active and inactive user accounts by sending crafted packets to an inverter and observing the response. This aids in further attacks, such as brute force attacks, as the attacker gains knowledge of existing users.
Original NVD description (English source)
An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, disclosing information regarding the application and allowing the attacker to create and save a .txt file with contents to his liking. An attacker may use this for information disclosure, or to write a file to normally unavailable locations on the local system. NOTE: the vendor reports that "the information contained in the debug report is of marginal significance." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected