CVE-2024-50696 | High | 7.5 | 2025-02-26 | SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an… |
CVE-2024-50693 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model. |
CVE-2024-50691 | High | 7.4 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is… |
CVE-2024-50689 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API model. |
CVE-2024-50688 | Critical | 9.8 | 2025-02-26 | SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the clou… |
CVE-2024-50687 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model. |
CVE-2024-50686 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService API model. |
CVE-2024-50685 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService API model. |
CVE-2024-50684 | Medium | 6.5 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to d… |
CVE-2024-50698 | Critical | 9.8 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content. |
CVE-2024-50697 | High | 8.1 | 2025-01-24 | In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bound… |
CVE-2024-50695 | Critical | 9.8 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds… |
CVE-2024-50694 | Critical | 9.8 | 2025-01-24 | In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of… |
CVE-2024-50692 | Medium | 5.4 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inve… |
CVE-2024-50690 | Medium | 6.5 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates. |