SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery Exploit Author: Borja Merino and Eduardo Villaverde Vendor Homepage: https://www.sma.de Version: Firmware Version 1.6 and prior Tested on: Sunny...

CVE-2019-13529

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which...

Code injection

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which...

CVE-2019-13529

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which...

CVE-2019-13529

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which...

CVE-2019-13529

CVE-2019-13529 affects SMA Solar Technology Sunny WebBox (Firmware 1.6 and prior). The vulnerability is Cross-Site Request Forgery (CSRF) where an attacker entices an authenticated operator to click a malicious link, enabling actions with the user’s permissions. Affected devices use IP-based comm...

CVE-2019-13529: Cross-Site Request Forgery (CSRF)

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which...

SMA Solar Technology AG Sunny WebBox

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: SMA Solar Technology AG Equipment: Sunny WebBox Vulnerability: Cross-Site Request Forgery 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to generate a...

PT-2019-3961

Name of the Vulnerable Software and Affected Versions Sunny WebBox Firmware versions 1.6 and prior Description The issue allows remote attackers to perform actions with the permissions of the user. This can be achieved by sending a malicious link to an authenticated operator. The device's use of ...

Sunny WebBox Detection (HTTP)

Detects the installed version of SMA Solar Technology AG Sunny WebBox. This script check the presence of SMA Solar Technology AG Sunny WebBox from the banner. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Sunny WebBox Hardcoded Credentials (HTTP)

Sunny WebBox is using known hardcoded credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SMA Solar Sunny WebBox Access

The vulnerability of the microprogramming software in the SMA Solar Sunny WebBox remote control system includes hard-coded default passwords. Exploiting this vulnerability could allow a malicious actor to gain access to the device remotely...

SMA Solar Sunny WebBox Privilege Gain Vulnerability

The SMA Solar Sunny WebBox is a device from SMA Germany for remote monitoring and maintenance of medium and large PV plants. A security vulnerability exists in the SMA Solar Sunny WebBox, which can be exploited by remote attackers to gain access...

Hardcoded credentials

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3964

CVE-2015-3964 affects SMA Solar Technology AG Sunny WebBox. The vulnerability arises from hardcoded credentials in Sunny WebBox firmware, enabling remote attackers to obtain complete access via unspecified remote vectors. The NVD listing assigns a CVSS v2 base score of 10.0 (HIGH) with AV:N/AC:L/...

CVE-2015-3964

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3964: Undefined Security Weakness

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

PT-2015-3055

Name of the Vulnerable Software and Affected Versions SMA Solar Sunny WebBox affected versions not specified Description The issue concerns hardcoded passwords in the SMA Solar Sunny WebBox system, making it easier for remote attackers to gain access. Recommendations At the moment, there is no...

SMA Solar Technology AG Sunny WebBox Hard-Coded Account Vulnerability

OVERVIEW This updated advisory is a follow-up to the advisory titled ICSA-15-181-02 SMA Solar Technology AG Sunny WebBox Hard-Coded Account Vulnerability that was published September 3, 2015, on the NCCIC/ICS-CERT web site. Aleksandr Timorin of PT Security has identified a hard-coded account...