CVE-2017-9858

An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks such as a brute force attack as one now knows exactly which users exist and which do no...

CVE-2017-9860

An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to authenticate. If an attacker is able to create a custom firmware version that is accepted by the inverter, the invert...

CVE-2017-9861

The CVE-2017-9861 impact concerns SMA Solar Technology products (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30) where the SIP channel lacks proper authentication with encryption. The underlying issue allows replay, packet injection, and man-in-the-middle attacks, enabling an attacker on ...

CVE-2017-9862

An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, disclosing information regarding the application and allowing the attacker to create and save a .txt file with contents to his liking. An...

CVE-2017-9854

CVE-2017-9854 affects SMA Solar Technology Sunny Explorer-related components. The issue allows an attacker to sniff specific localhost packets and read plaintext passwords as users type them into Sunny Explorer, potentially compromising the entire device. Affected products are Sunny Boy TLST-21/T...

CVE-2017-9854

An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that...

CVE-2017-9856

The connected PT-2017-19222 entry confirms concrete technical details: SMA Solar Technology inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30) use a simple encryption algorithm for SMAdata2+ passwords, allowing an attacker to decrypt passwords to plaintext and authenticate to the ...

CVE-2017-9856

An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algorithm. This enables an attacker to find the plaintext passwords and authenticate to the device...

CVE-2017-9857

The vulnerability CVE-2017-9857 in SMA Solar Technology products stems from the SMAdata2+ protocol: it does not properly use authentication with encryption, making it vulnerable to man-in-the-middle, packet injection, and replay attacks. Affected are Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-...

CVE-2017-9857

An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, etc. can be...

CVE-2017-9852

CVE-2017-9852 affects SMA Solar Technology products (notably Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30). It describes an Incorrect Password Management issue: default passwords are rarely changed; user passwords are often default; installer passwords are often default or similar acros...

CVE-2017-9851

An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny Boy...

PT-2017-19224 · Sma Solar Technology · Sunny Boy Tlst-21 +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, and Sunny Tripower TL-10, TL-30 Description: An issue in SMA Solar Technology products allows determination of active and inactive user accounts by sending crafted packets ...

PT-2017-19217 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products where sending nonsense data or...

Sunny WebBox Detection (HTTP)

Detects the installed version of SMA Solar Technology AG Sunny WebBox. This script check the presence of SMA Solar Technology AG Sunny WebBox from the banner. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

SMA Solar Sunny WebBox Privilege Gain Vulnerability

The SMA Solar Sunny WebBox is a device from SMA Germany for remote monitoring and maintenance of medium and large PV plants. A security vulnerability exists in the SMA Solar Sunny WebBox, which can be exploited by remote attackers to gain access...

CVE-2015-3964

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

Hardcoded credentials

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3964

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3964

CVE-2015-3964 affects SMA Solar Technology AG Sunny WebBox. The vulnerability arises from hardcoded credentials in Sunny WebBox firmware, enabling remote attackers to obtain complete access via unspecified remote vectors. The NVD listing assigns a CVSS v2 base score of 10.0 (HIGH) with AV:N/AC:L/...