CVE-2017-9863

SMA Solar Technology Sunny Explorer-related CSRF vulnerability (CVE-2017-9863) affects Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30. When a user runs Sunny Explorer and visits a malicious host, an unauthenticated attacker can exploit cross-site request forgery to change inverter setting...

CVE-2017-9861

An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the...

CVE-2017-9860

The CVE concerns SMA Solar Technology inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30). A lack of authentication allows firmware updates via Sunny Explorer or the SMAdata2+ protocol, enabling a forged firmware version to be accepted and the inverter to be fully compromised (poss...

CVE-2017-9864

Summary of CVE-2017-9864 (SMA Solar Technology inverter/time setting issue) : An attacker can change the plant time on SMA Solar Technology inverters (notably Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30) without authentication, causing the system time to shift. This can affect timestam...

CVE-2017-9855

The CVE-2017-9855 issue affects SMA Solar Technology inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30). The vulnerability arises from the Grid Guard secondary authentication system, which uses predictable codes that can be reused across any SMA inverter. When combined with the in...

CVE-2017-9862

SMA Solar Technology Sunny Explorer information-disclosure (CVE-2017-9862) affects Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30. When signing in with an incorrect password, a debug report can be created that exposes application information and allows saving a .txt file with arbitrary co...

CVE-2017-9862

An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, disclosing information regarding the application and allowing the attacker to create and save a .txt file with contents to his liking. An...

CVE-2017-9852

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company but a...

A Dangerous Vulnerability in Solar Panels can Cause Power Outage

By Waqas Willem Westerhof, a cybersecurity researcher at Dutch security firm ITsec, This is a post from HackRead.com Read the original post: A Dangerous Vulnerability in Solar Panels can Cause Power Outage...

PT-2017-19224 · Sma Solar Technology · Sunny Boy Tlst-21 +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, and Sunny Tripower TL-10, TL-30 Description: An issue in SMA Solar Technology products allows determination of active and inactive user accounts by sending crafted packets ...

PT-2017-19217 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products where sending nonsense data or...

CVE-2017-9863: Cross-Site Request Forgery (CSRF)

An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request forgery can be used to change settings in the inverters for example, issuing a POST request to change the user password. All Sunny Explorer...

PT-2017-19225 · Sma Solar Technology · Tl-30 +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30 affected versions not specified Description: An issue was discovered in SMA Solar Technology products where the inverters use a weak hashing...

CVE-2017-9861: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the...

CVE-2017-9864: Undefined Security Weakness

An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system time, possibly affecting lockout policies and random-number generators based on timestamps, and makes timestamps for data analysis...

CVE-2017-9858: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks such as a brute force attack as one now knows exactly which users exist and which do no...

CVE-2017-9855: Incorrect Authorization

An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers called the Grid Guard system. This system uses predictable codes, and a single Grid Guard code can be used on any SMA inverter. Any such code, when combined with the installer...

CVE-2017-9852: Use of Hard-coded Credentials

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company but a...

CVE-2017-9851: Undefined Security Weakness

An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny Boy...

CVE-2017-9860: Improper Authentication

An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to authenticate. If an attacker is able to create a custom firmware version that is accepted by the inverter, the invert...