CVE-2024-50689

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...

CVE-2024-50685: Authorization Bypass Through User-Controlled Key

SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references IDOR via the powerStationService API model...

CVE-2024-50689: Authorization Bypass Through User-Controlled Key

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...

CVE-2024-50687: Authorization Bypass Through User-Controlled Key

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the devService API model...

CVE-2024-50686

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the commonService API model...

PT-2025-8743

Name of the Vulnerable Software and Affected Versions SunGrow iSolarCloud versions prior to the October 31, 2024 remediation Description The issue is related to insecure direct object references IDOR via the devService API model. Recommendations For versions prior to the October 31, 2024...

PT-2025-8745

Name of the Vulnerable Software and Affected Versions SunGrow iSolarCloud versions prior to the October 31, 2024 remediation Description The issue is related to insecure direct object references IDOR via the "orgService API model". Recommendations For versions prior to the October 31, 2024...

CVE-2024-50684

The SunGrow iSolarCloud Android app (version V2.1.6.20241017 and prior) is vulnerable to a security flaw involving the use of an insecure AES key with insufficient entropy to encrypt client data. This vulnerability may allow an attacker to decrypt intercepted communications between the mobile app...

CVE-2024-50693

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the userService API model...

SunGrow iSolarCloud 安全漏洞

SunGrow iSolarCloud is an Android app for new energy power plant management from China SunGrow SunGrow. It is used for power plant data collection, monitoring, operation and maintenance and operation management. A security vulnerability exists in the SunGrow iSolarCloud Android app version...

PT-2025-8748

Name of the Vulnerable Software and Affected Versions SunGrow WiNet-S versions V200.001.00.P025 and earlier Description The issue is related to missing integrity checks for firmware upgrades. By sending a specific MQTT message, it is possible to update an inverter or a WiNet connectivity dongle...

CVE-2024-50696: Download of Code Without Integrity Check

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...

CVE-2024-50696

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...

SunGrow iSolarCloud 安全漏洞

SunGrow iSolarCloud is an Android app for new energy power plant management from China SunGrow SunGrow. It is used for power plant data collection, monitoring, operation and maintenance and operation management. A security vulnerability exists in SunGrow iSolarCloud Android app version...

PT-2025-8742

Name of the Vulnerable Software and Affected Versions SunGrow iSolarCloud versions prior to the October 31, 2024 remediation Description The issue is related to insecure direct object references IDOR via the commonService API model. Recommendations For versions prior to the October 31, 2024...

CVE-2024-50686: Authorization Bypass Through User-Controlled Key

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the commonService API model...

CVE-2024-50696

The SunGrow WiNet-S LAN communication module (versions V200.001.00.P025 and earlier) is vulnerable to a firmware integrity issue. The root cause is a lack of integrity checks during the firmware upgrade process, which allows an attacker to send a specific MQTT message to trigger an update. This c...

CVE-2024-50687

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the devService API model...

SunGrow WiNet-S TLV Field Stack Buffer Overflow Vulnerability

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A stack buffer overflow vulnerability exists in the SunGrow WiNet-S TLV field that originates from code that does not have sufficient boundary checks when parsing a specific TLV field. An attacker could exploit this vulnerability ...

SunGrow WiNet-S Trust Management Issues Vulnerability

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A trust management issue vulnerability exists in SunGrow WiNet-S version V200.001.00.P027 and prior versions, which stems from the use of hard-coded MQTT credentials. An attacker could use this vulnerability to send arbitrary...