Browse CVEs

CRITICAL 9.8 CVE-2024-50688 SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) an… Isolarcloud 2.1.6.20241104+ Fix from $2,3002025-02-26 CRITICAL 9.1 CVE-2024-50685 SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService AP… Isolarcloud 2024-10-31+ Fix from $2,3002025-02-26 CRITICAL 9.1 CVE-2024-50686 SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService API model. Isolarcloud 2024-10-31+ Fix from $2,3002025-02-26 CRITICAL 9.1 CVE-2024-50687 SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model. Isolarcloud 2024-10-31+ Fix from $2,3002025-02-26 CRITICAL 9.1 CVE-2024-50689 SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API model. Isolarcloud 2024-10-31+ Fix from $2,3002025-02-26 CRITICAL 9.1 CVE-2024-50693 SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model. Isolarcloud 2024-10-31+ Fix from $2,3002025-02-26 HIGH 7.5 CVE-2024-50696 SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an up… Winet S Firmware after 200.001.00.P025 Fix from $1,9502025-02-26 HIGH 7.4 CVE-2024-50691 SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate err… Isolarcloud 2.1.6.20241115+ Fix from $1,9502025-02-26 MEDIUM 6.5 CVE-2024-50684 SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow atta… Isolarcloud 2.1.6.20241104+ Fix from $1,6002025-02-26 CRITICAL 9.8 CVE-2024-50694 In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the… Winet S Firmware 200.001.00.p027+ Fix from $2,3002025-01-24 CRITICAL 9.8 CVE-2024-50695 SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT top… Winet S Firmware 200.001.00.p027+ Fix from $2,3002025-01-24 CRITICAL 9.8 CVE-2024-50698 SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content. Winet S Firmware 200.001.00.p027+ Fix from $2,3002025-01-24 HIGH 8.1 CVE-2024-50697 In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have suffic… Winet S Firmware 200.001.00.p027+ Fix from $1,9502025-01-24 MEDIUM 6.5 CVE-2024-50690 SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates. Winet S Firmware 200.001.00.p027+ Fix from $1,6002025-01-24 MEDIUM 5.4 CVE-2024-50692 SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbi… Winet S Firmware 200.001.00.p027+ Fix from $1,6002025-01-24