CVE-2025-7769

CVE-2025-7769 – حقن أوامر عن بُعد في mobileapi الوصف: يحتوي هذا المستودع على إثبات المفهوم PoC لاستغلال ثغرة CVE‑2025‑7769 ، وهي ثغرة حرجة في حقن الأوامر عن بُعد موجودة في أجهزة Tigo Energy CCA التي تعرض نقطة النهاية /cgi-bin/mobileapi. يتم تشغيل الثغرة عن طريق حقن أوامر نظام التشغيل عبر مفتاح JS...

Tigo Energy CCA Command Injection

This repository contains a proof of concept exploit exploit for CVE‑2025‑7769, a critical remote command injection vulnerability found in Tigo Energy CCA appliances exposing the /cgi-bin/mobileapi endpoint...

CVE-2025-7770

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID...

CVE-2025-7770: Predictable Seed in Pseudo-Random Number Generator (PRNG)

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID...

PT-2025-32227 · Tigo Energy · Tigo Energy Cca

Name of the Vulnerable Software and Affected Versions: Tigo Energy CCA affected versions not specified Description: The Tigo Energy CCA is susceptible to a command injection issue in the /cgi-bin/mobile api endpoint when the DEVICE PING command is invoked. This allows for remote code execution du...