User Enumeration Vulnerability in SMA Solar Technology Products

CVE-2017-9858

What is CVE-2017-9858?

A vulnerability in SMA Solar Technology products allows attackers to determine the existence of active and inactive user accounts by sending specially crafted packets to the inverters. This information may assist attackers in executing further exploits, such as brute force attacks, by identifying legitimate usernames. The products affected include specific models of Sun Boy and Sunny Tripower inverters. The vendor maintains that this does not represent a security gap itself, but it does pose a risk for subsequent attacks.

References