Sungrowpower Winet-S
7 CVEs affecting Sungrowpower Winet-S. Latest disclosed: 2025-02-26. Critical: 3, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50698 | Critical | 9.8 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content. |
CVE-2024-50695 | Critical | 9.8 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds… |
CVE-2024-50694 | Critical | 9.8 | 2025-01-24 | In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of… |
CVE-2024-50697 | High | 8.1 | 2025-01-24 | In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bound… |
CVE-2024-50696 | High | 7.5 | 2025-02-26 | SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an… |
CVE-2024-50690 | Medium | 6.5 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates. |
CVE-2024-50692 | Medium | 5.4 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inve… |