CVE-2021-46416

HighCVSS 8.1

Published: 07/04/2022(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.69%

93th percentile - higher than 93% of all known CVEs

Summary

The vulnerability in SUNNY TRIPOWER 5.0 firmware version 3.10.16.R allows unauthorized user groups to access resources due to insecure cookie handling. This is an Insecure Direct Object Reference (IDOR) issue.

Risk Assessment

An attacker may gain access to functions or data intended for other user groups, potentially leading to confidentiality and integrity breaches.

Recommendation

Immediately update SUNNY TRIPOWER 5.0 firmware to the latest available version and implement session-based authentication and authorization mechanisms.

Original NVD description (English source)

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.