CVE-2024-50693

SunGrow iSolarCloud ecosystem (Android app and cloud) is affected by insecure direct object references (IDOR) via the userService API model, with the Solar iCloud API and related services (powerStationService, orgService, commonService, devService) exposing unauthorized access to user data and po...

CVE-2024-50686

SunGrow iSolarCloud (Android app and cloud) is affected by insecure direct object references (IDOR) via the commonService API model, with multiple CVE-2024-50686 references across NVD/Red Hat/CISA/CNNVD and related feeds. The publicly documented details specify IDOR exposure in the commonService ...

CVE-2024-50687

CVE-2024-50687 (SunGrow iSolarCloud) : The SunGrow iSolarCloud ecosystem (Android app and cloud) is vulnerable to multiple insecure direct object references (IDOR) via the devService API model, with related exposure noted for powerStationService, userService, orgService, and commonService APIs. T...

CVE-2024-50689

SunGrow iSolarCloud vulnerability (CVE-2024-50689) affects the Android app and cloud API. The issue is insecure direct object references (IDOR) via the orgService API model, potentially allowing unauthorized access to user data and modification of identifying data values. The CVE entry notes reme...

CVE-2024-50685

SunGrow iSolarCloud is vulnerable to insecure direct object references (IDOR) in the powerStationService API model, affecting the iSolarCloud Android app and related cloud services. The root cause is IDOR flaws that could allow unauthorized access to user data and potentially modify key identifyi...

CVE-2024-50684

SunGrow iSolarCloud Android app (V2.1.6.20241017 and earlier) uses an insecure AES key with insufficient entropy, enabling potential decryption of intercepted communications between the mobile app and iSolarCloud. The vulnerability affects client data encryption in the Android app, with the risk ...

CVE-2024-50688

SunGrow iSolarCloud Android app (v2.1.6.20241017 and earlier) uses hardcoded MQTT credentials for device telemetry, with the same credentials in the app and cloud. The vulnerability is described as enabling attackers to gain unauthorized access to user accounts and potentially execute arbitrary c...

CVE-2024-50691

SunGrow iSolarCloud Android app (V2.1.6.20241104 and earlier) is affected by missing SSL certificate validation, allowing MITM impersonation of the iSolarCloud server. The vulnerability enables an attacker to intercept or modify communications between the Android app and the server. CVSSv3.1 base...