CVE-2017-9862 Information disclosure in n/a
An attacker can generate debug reports to disclose application information and write arbitrary files to the local system via Sunny Explorer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9862?
CVE-2017-9862 is a high-severity vulnerability in n/a, published on 5 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, disclosing information regarding the application and allowing the attacker to create and save a .txt file with contents to his liking. An attacker may use this for information disclosure, or to write a file to normally unavailable locations on the local system. NOTE: the vendor reports that "the information contained in the debug report is of marginal significance." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
Weakness: CWE-200
Which versions are affected by CVE-2017-9862?
It affects 1 product.
Products include Sma Sunny Explorer.
How do I fix CVE-2017-9862?
No fix has been published for CVE-2017-9862 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-9862 being exploited?
There is no known exploitation of CVE-2017-9862 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9r8f-6c3x-5c96.