Sungrowpower Isolarcloud
8 CVEs affecting Sungrowpower Isolarcloud. Latest disclosed: 2025-02-26. Critical: 6, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50688 | Critical | 9.8 | 2025-02-26 | SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the clou… |
CVE-2024-50693 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model. |
CVE-2024-50689 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API model. |
CVE-2024-50687 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model. |
CVE-2024-50686 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService API model. |
CVE-2024-50685 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService API model. |
CVE-2024-50691 | High | 7.4 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is… |
CVE-2024-50684 | Medium | 6.5 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to d… |