CVE-2024-50693

The SunGrow iSolarCloud Android application, used for new energy power plant management, is vulnerable to Insecure Direct Object References (IDOR) in the userService API model . This flaw, categorized under CWE-639 , allows for authorization bypass via user-controlled keys. The vulnerability affe...

CVE-2024-50686

The SunGrow iSolarCloud Android application, used for new energy power plant management, is vulnerable to Insecure Direct Object References (IDOR) . This vulnerability exists in the commonService API model , allowing for unauthorized access to objects or data. Versions released before the October...

CVE-2024-50687

SunGrow iSolarCloud , an Android application used for power plant data collection and management, is vulnerable to Insecure Direct Object References (IDOR) in the devService API model . This flaw allows for an authorization bypass through user-controlled keys, potentially impacting confidentialit...

CVE-2024-50689

SunGrow iSolarCloud , an Android application for new energy power plant management, is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists within the orgService API model , potentially allowing unauthorized access or actions. This vulnerability affects versions released pri...

CVE-2024-50685

The SunGrow iSolarCloud Android application, used for new energy power plant management, is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists within the powerStationService API model , potentially allowing unauthorized access to data. This vulnerability affects versions r...

CVE-2024-50684

The SunGrow iSolarCloud Android app (version V2.1.6.20241017 and prior) is vulnerable to a security flaw involving the use of an insecure AES key with insufficient entropy to encrypt client data. This vulnerability may allow an attacker to decrypt intercepted communications between the mobile app...

CVE-2024-50688

The SunGrow iSolarCloud Android application (versions V2.1.6.20241017 and prior) contains hardcoded credentials . The application and the associated cloud service utilize the same MQTT credentials for exchanging device telemetry, regardless of the specific user account. This vulnerability allows ...

CVE-2024-50691

The SunGrow iSolarCloud Android app (versions V2.1.6.20241104 and prior ) is vulnerable to Man-in-the-Middle (MiTM) attacks due to Missing SSL Certificate Validation . The application explicitly ignores certificate errors, allowing an attacker to impersonate the iSolarCloud server and intercept c...