Cross-Site Request Forgery in SMA Solar Technology Sunny Explorer

CVE-2017-9863

What is CVE-2017-9863?

An identified issue in SMA Solar Technology's products allows for cross-site request forgery (CSRF) when users run the Sunny Explorer application while visiting a malicious host. This vulnerability may enable attackers to issue unauthorized commands, such as modifying user passwords or altering other settings to which the user has access. In certain circumstances, this could even extend to settings beyond the user’s permissions, leading to a potential full compromise of the affected devices. It's important to note that the impact is limited due to the low usage frequency of Sunny Explorer, and primarily affects specific inverter models.

References