CVE-2024-50691

SunGrow iSolarCloud Android app (V2.1.6.20241104 and earlier) is affected by missing SSL certificate validation, allowing MITM impersonation of the iSolarCloud server. The vulnerability enables an attacker to intercept or modify communications between the Android app and the server. CVSSv3.1 base...

CVE-2024-50689

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the orgService API model...

SunGrow WiNet-S 安全漏洞

The SunGrow WiNet-S is a LAN communication module from China's SunGrow Power SunGrow. A security vulnerability exists in SunGrow WiNet-S version V200.001.00.P025 and prior versions, which stems from a firmware upgrade that lacks integrity checking...

SunGrow iSolarCloud 安全漏洞

SunGrow iSolarCloud is an Android app for new energy power plant management from China SunGrow SunGrow. It is used for power plant data collection, monitoring, operation and maintenance and operation management. A security vulnerability exists in SunGrow iSolarCloud version V2.1.6.20241017 and...

CVE-2024-50693

SunGrow iSolarCloud ecosystem (Android app and cloud) is affected by insecure direct object references (IDOR) via the userService API model, with the Solar iCloud API and related services (powerStationService, orgService, commonService, devService) exposing unauthorized access to user data and po...

CVE-2024-50687

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the devService API model...

CVE-2024-50688

SunGrow iSolarCloud Android app (v2.1.6.20241017 and earlier) uses hardcoded MQTT credentials for device telemetry, with the same credentials in the app and cloud. The vulnerability is described as enabling attackers to gain unauthorized access to user accounts and potentially execute arbitrary c...

CVE-2024-50684

SunGrow iSolarCloud Android app (V2.1.6.20241017 and earlier) uses an insecure AES key with insufficient entropy, enabling potential decryption of intercepted communications between the mobile app and iSolarCloud. The vulnerability affects client data encryption in the Android app, with the risk ...

CVE-2024-50693

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the userService API model...

CVE-2024-50684

SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data insufficient entropy. This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud...

CVE-2024-50686

SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references IDOR via the commonService API model...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

CVE-2024-50685

SunGrow iSolarCloud is vulnerable to insecure direct object references (IDOR) in the powerStationService API model, affecting the iSolarCloud Android app and related cloud services. The root cause is IDOR flaws that could allow unauthorized access to user data and potentially modify key identifyi...

SunGrow WiNet-S Stack Buffer Overflow Vulnerability

SunGrow WiNet-S is a LAN communication module from SunGrow, China. The SunGrow WiNet-S suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system or cause a denial of service...

SunGrow WiNet-S stack buffer overflow vulnerability (CNVD-2025-03255)

SunGrow WiNet-S is a LAN communication module from SunGrow, China. The SunGrow WiNet-S suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system or cause a denial of service...

Unspecified Vulnerability in SunGrow WiNet-S

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A security vulnerability exists in SunGrow WiNet-S version V200.001.00.P027 and prior versions, which can be exploited by an attacker to decrypt all firmware updates...

SunGrow WiNet-S Storage Message Stack Buffer Overflow Vulnerability

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A stack buffer overflow vulnerability exists in SunGrow WiNet-S stored messages. The vulnerability stems from the base code not checking the bounds of the buffer used to store messages when replicating timestamped reads of MQTT...

SunGrow WiNet-S TLV Field Stack Buffer Overflow Vulnerability

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A stack buffer overflow vulnerability exists in the SunGrow WiNet-S TLV field that originates from code that does not have sufficient boundary checks when parsing a specific TLV field. An attacker could exploit this vulnerability ...

SunGrow WiNet-S Trust Management Issues Vulnerability

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A trust management issue vulnerability exists in SunGrow WiNet-S version V200.001.00.P027 and prior versions, which stems from the use of hard-coded MQTT credentials. An attacker could use this vulnerability to send arbitrary...

CVE-2024-50694

In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow...