CVE-2025-46414 EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts
Attackers can brute-force PINs to gain unauthorized access to EG4 solar inverters if they know the device serial number.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46414?
CVE-2025-46414 is a critical authentication bypass vulnerability in EG4 12000XP, published on 8 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides clear feedback when the correct PIN is entered. This vulnerability was patched in a server-side update on April 6, 2025.
Weakness: CWE-307
Which versions are affected by CVE-2025-46414?
How do I fix CVE-2025-46414?
No fix has been published for CVE-2025-46414 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-46414 being exploited?
There is no known exploitation of CVE-2025-46414 in the wild and no public exploit code.
Sources
Also known as GHSA-xh3j-m8p6-2hjh.