CVE-2017-9864
HighSummary
An issue was discovered in SMA Solar Technology products that allows an attacker to change the system time without any authentication. This can affect lockout policies and random-number generators based on timestamps.
Risk Assessment
Changing the system time may lead to unreliable timestamps in data analysis, potentially affecting log integrity. However, the vendor reports that this issue is largely irrelevant as the plant time would later be reset via NTP.
Recommendation
It is recommended to monitor and secure access to systems to prevent unauthorized time changes. Additionally, consider implementing measures to verify log integrity.
Other vulnerabilities in Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, TL-30
See all- CVE-2017-9862High
An issue was discovered in SMA Solar Technology products that allows the creation of a debug report when signed into Sunny Explorer with a wrong password. This enables an attacker to disclose information regarding the application and save a .txt file with arbitrary content.
- CVE-2017-9858High
An issue was discovered in SMA Solar Technology products that allows determining active and inactive user accounts by sending crafted packets to an inverter and observing the response. This aids in further attacks, such as brute force attacks, as the attacker gains knowledge of existing users.
Original NVD description (English source)
An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system time, possibly affecting lockout policies and random-number generators based on timestamps, and makes timestamps for data analysis unreliable. NOTE: the vendor reports that this is largely irrelevant because it only affects log-entry timestamps, and because the plant time would later be reset via NTP. (It has never been the case that a lockout policy or random-number generator was affected.) Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected