Sma
21 CVEs across 152 Sma products. Browse Sma vulnerabilities, severities, and proof-of-concept exploits.
Sma products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4459 | Medium | 6.5 | 2025-08-27 | An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected… |
CVE-2025-41685 | Medium | 6.5 | 2025-08-19 | A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address. |
CVE-2025-41645 | High | 8.6 | 2025-05-13 | An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake. |
CVE-2025-0731 | Medium | 6.5 | 2025-02-26 | An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the securi… |
CVE-2024-11025 | Medium | 5.4 | 2024-11-27 | An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access… |
CVE-2024-1890 | Medium | 6.4 | 2024-02-26 | Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack… |
CVE-2024-1889 | High | 8.8 | 2024-02-26 | Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a maliciou… |
CVE-2021-46416 | High | 8.1 | 2022-04-07 | Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling. |
CVE-2019-13529 | High | 8.8 | 2019-10-09 | An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on t… |
CVE-2017-9864 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system… |
CVE-2017-9863 | High | 8.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request f… |
CVE-2017-9862 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, discl… |
CVE-2017-9861 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to repl… |
CVE-2017-9860 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware wi… |
CVE-2017-9859 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. Thi… |
CVE-2017-9858 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accoun… |
CVE-2017-9857 | High | 8.1 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vuln… |
CVE-2017-9856 | Low | 3.4 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encry… |
CVE-2017-9855 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers called the Grid Guard system. This syst… |
CVE-2017-9854 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are ty… |
CVE-2017-9853 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity req… |
CVE-2017-9852 | Critical | 9.8 | 2017-08-05 | An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will al… |
CVE-2017-9851 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the a… |