deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12434
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/ImageMagick/ImageMagick/issues/547; https://www.debian.org/security/2017/dsa-4019; https://github.com/ImageMagick/ImageMagick/issues/547
CVE: CVE-2017-12435
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.securityfocus.com/bid/100152; https://github.com/ImageMagick/ImageMagick/issues/543; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-12413
Published: 2017-08-04
Description: AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/143657/Axis-2100-Network-Camera-2.43-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/143657/Axis-2100-Network-Camera-2.43-Cross-Site-Scripting.html
CVE: CVE-2017-11657
Published: 2017-08-04
Description: Dashlane might allow local users to gain privileges by placing a Trojan horse WINHTTP.dll in the %APPDATA%\Dashlane directory.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: https://blogs.securiteam.com/index.php/archives/3357; https://blogs.securiteam.com/index.php/archives/3357
CVE: CVE-2017-10949
Published: 2017-08-04
Description: Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf; http://www.securityfocus.com/bid/100138; http://www.zerodayinitiative.com/advisories/ZDI-17-523
CVE: CVE-2017-12448
Published: 2017-08-04
Description: The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21787; https://sourceware.org/bugzilla/show_bug.cgi?id=21787
CVE: CVE-2017-12449
Published: 2017-08-04
Description: The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21840; https://sourceware.org/bugzilla/show_bug.cgi?id=21840
CVE: CVE-2017-12450
Published: 2017-08-04
Description: The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21813; https://sourceware.org/bugzilla/show_bug.cgi?id=21813
CVE: CVE-2017-12451
Published: 2017-08-04
Description: The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21786; https://sourceware.org/bugzilla/show_bug.cgi?id=21786
CVE: CVE-2017-12452
Published: 2017-08-04
Description: The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21813; https://sourceware.org/bugzilla/show_bug.cgi?id=21813
CVE: CVE-2017-12453
Published: 2017-08-04
Description: The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21813; https://sourceware.org/bugzilla/show_bug.cgi?id=21813
CVE: CVE-2017-12454
Published: 2017-08-04
Description: The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21813; https://sourceware.org/bugzilla/show_bug.cgi?id=21813
CVE: CVE-2017-12455
Published: 2017-08-04
Description: The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21840; https://sourceware.org/bugzilla/show_bug.cgi?id=21840
CVE: CVE-2017-12456
Published: 2017-08-04
Description: The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://security.gentoo.org/glsa/201801-01; https://sourceware.org/bugzilla/show_bug.cgi?id=21813; https://security.gentoo.org/glsa/201801-01
CVE: CVE-2017-12457
Published: 2017-08-04
Description: The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21840; https://sourceware.org/bugzilla/show_bug.cgi?id=21840
CVE: CVE-2017-12458
Published: 2017-08-04
Description: The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21840; https://sourceware.org/bugzilla/show_bug.cgi?id=21840
CVE: CVE-2017-12459
Published: 2017-08-04
Description: The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceware.org/bugzilla/show_bug.cgi?id=21840; https://sourceware.org/bugzilla/show_bug.cgi?id=21840
CVE: CVE-2017-10815
Published: 2017-08-04
Description: MaLion for Windows 5.2.1 and earlier (only when "Remote Control" is installed) and MaLion for Mac 4.0.1 to 5.2.1 (only when "Remote Control" is installed) allow remote attackers to bypass authentication to execute arbitrary commands or operations on Terminal Agent.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.intercom.co.jp/information/2017/0801.html; https://jvn.jp/en/vu/JVNVU91587298/index.html; http://www.intercom.co.jp/information/2017/0801.html
CVE: CVE-2017-10816
Published: 2017-08-04
Description: SQL injection vulnerability in the MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.intercom.co.jp/information/2017/0801.html; https://jvn.jp/en/vu/JVNVU91587298/index.html; http://www.intercom.co.jp/information/2017/0801.html
CVE: CVE-2017-10817
Published: 2017-08-04
Description: MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.intercom.co.jp/information/2017/0801.html; https://jvn.jp/en/vu/JVNVU91587298/index.html; http://www.intercom.co.jp/information/2017/0801.html
CVE: CVE-2017-10818
Published: 2017-08-04
Description: MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal Agent and spoof the Relay Service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.intercom.co.jp/information/2017/0801.html; https://jvn.jp/en/vu/JVNVU91587298/index.html; http://www.intercom.co.jp/information/2017/0801.html
CVE: CVE-2017-10819
Published: 2017-08-04
Description: MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.intercom.co.jp/information/2017/0801.html; https://jvn.jp/en/vu/JVNVU91587298/index.html; http://www.intercom.co.jp/information/2017/0801.html
CVE: CVE-2017-10820
Published: 2017-08-04
Description: Untrusted search path vulnerability in Installer of IP Messenger for Win 4.60 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://ipmsg.org/ipmsg_dll_vulnerability.html.en; https://jvn.jp/en/jp/JVN86724730/index.html; https://ipmsg.org/ipmsg_dll_vulnerability.html.en
CVE: CVE-2017-1331
Published: 2017-08-04
Description: IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126233.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22003928; http://www.securityfocus.com/bid/100120; https://exchange.xforce.ibmcloud.com/vulnerabilities/126233
CVE: CVE-2017-2221
Published: 2017-08-04
Description: Untrusted search path vulnerability in Installer of Baidu IME Ver3.6.1.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN17788774/index.html; https://jvn.jp/en/jp/JVN17788774/index.html
CVE: CVE-2017-12481
Published: 2017-08-04
Description: The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://bugs.ledger-cli.org/show_bug.cgi?id=1222; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00029.html
CVE: CVE-2017-12482
Published: 2017-08-04
Description: The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://bugs.ledger-cli.org/show_bug.cgi?id=1224; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00029.html
CVE: CVE-2017-12419
Published: 2017-08-05
Description: If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL's "connect file read" feature to remotely access files on the MantisBT server.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://openwall.com/lists/oss-security/2017/08/04/6; http://www.securityfocus.com/bid/100142; https://mantisbt.org/bugs/view.php?id=23173
CVE: CVE-2017-12439
Published: 2017-08-05
Description: SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated redirection issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/143542/Flash-Slideshow-Maker-Professional-XSS-Content-Forgery-Redirect.html; https://packetstormsecurity.com/files/143542/Flash-Slideshow-Maker-Professional-XSS-Content-Forgery-Redirect.html
CVE: CVE-2017-7533
Published: 2017-08-05
Description: Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=49d31c2f389acfe83417083e1208422b4091cd9e; http://openwall.com/lists/oss-security/2017/08/03/2; http://www.debian.org/security/2017/dsa-3927
CVE: CVE-2017-12562
Published: 2017-08-05
Description: Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/erikd/libsndfile/issues/292; https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html; https://security.gentoo.org/glsa/201811-23
CVE: CVE-2017-9851
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 7.5 (HIGH)
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9852
Published: 2017-08-05
Description: An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company (but are sometimes changed). Hidden user accounts have (at least in some cases, though more research is required to test this for all hidden user accounts) a fixed password for all devices; it can never be changed by a user. Other vulnerabilities exist that allow an attacker to get the passwords of these hidden user accounts. NOTE: the vendor reports that it has no influence on the allocation of passwords, and that global hardcoded master passwords do not exist. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9853
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of characters. NOTE: the vendor reports that the 12-character limit provides "a very high security standard." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9854
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that exploitation likelihood is low because these packets are usually sent only once during installation. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9855
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers called the Grid Guard system. This system uses predictable codes, and a single Grid Guard code can be used on any SMA inverter. Any such code, when combined with the installer account, allows changing very sensitive parameters. NOTE: the vendor reports that Grid Guard is not an authentication feature; it is only a tracing feature. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9856
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algorithm. This enables an attacker to find the plaintext passwords and authenticate to the device. NOTE: the vendor reports that only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 3.4 (LOW)
CWE: CWE-256
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9857
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, etc. can be replayed, injected, or used for a man in the middle session. All functionalities available in Sunny Explorer can effectively be done from anywhere within the network as long as an attacker gets the packet setup correctly. This includes the authentication process for all (including hidden) access levels and the changing of settings in accordance with the gained access rights. Furthermore, because the SMAdata2+ communication channel is unencrypted, an attacker capable of understanding the protocol can eavesdrop on communications. NOTE: the vendor's position is that authentication with encryption is not required on an isolated subnetwork. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9858
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks (such as a brute force attack) as one now knows exactly which users exist and which do not. NOTE: the vendor's position is that this "is not a security gap per se." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9859
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline crackers. This cracked password can then be used to register at the SMA servers. NOTE: the vendor's position is that "we consider the probability of the success of such manipulation to be extremely low." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/
CVE: CVE-2017-9860
Published: 2017-08-05
Description: An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to authenticate. If an attacker is able to create a custom firmware version that is accepted by the inverter, the inverter is compromised completely. This allows the attacker to do nearly anything: for example, giving access to the local OS, creating a botnet, using the inverters as a stepping stone into companies, etc. NOTE: the vendor reports that this attack has always been blocked by "a final integrity and compatibility check." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.sma.de/en/statement-on-cyber-security.html; http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf; https://horusscenario.com/CVE-information/