CVE-2017-9852 Hardcoded credentials in n/a
Attackers can exploit hardcoded default and hidden user passwords to gain unauthorized access to SMA Solar Technology inverters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9852?
CVE-2017-9852 is a critical vulnerability in n/a, published on 5 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company (but are sometimes changed). Hidden user accounts have (at least in some cases, though more research is required to test this for all hidden user accounts) a fixed password for all devices; it can never be changed by a user. Other vulnerabilities exist that allow an attacker to get the passwords of these hidden user accounts. NOTE: the vendor reports that it has no influence on the allocation of passwords, and that global hardcoded master passwords do not exist. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
Weakness: CWE-798
Which versions are affected by CVE-2017-9852?
It affects 39 products.
Products include Sma Sunny Boy 1.5 Firmware, Sma Sunny Boy 2.5 Firmware, Sma Sunny Boy 3.0 Firmware, Sma Sunny Boy 3.6 Firmware, Sma Sunny Boy 3000tl Firmware, Sma Sunny Boy 3600 Firmware and 33 more.
How do I fix CVE-2017-9852?
No fix has been published for CVE-2017-9852 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-9852 being exploited?
There is no known exploitation of CVE-2017-9852 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2fg4-v4xr-h42m.