Multiple vulnerabilities in Sungrow iSolarCloud Android App

Published: 2025-03-14

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-50688 CVE-2024-50684
CWE-ID	CWE-798 CWE-327
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	iSolarCloud Android App Mobile applications / Apps for mobile phones
Vendor	Sungrow

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Use of hard-coded credentials

EUVDB-ID: #VU105732

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-50688

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to the iSolarCloud Android application and the cloud use hard-coded MQTT credentials for exchanging the device telemetry. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

iSolarCloud Android App: 2.1.6.20241017

CPE2.3

External links

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-12
https://en.sungrowpower.com/security-notice-detail-2/6122

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU105726

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-50684

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm