Hardcoded Credentials in SunGrow iSolarCloud Android Application

CVE-2024-50688

What is CVE-2024-50688?

The SunGrow iSolarCloud Android application version 2.1.6.20241017 and earlier contains hardcoded MQTT credentials, which are used for the exchange of device telemetry regardless of the user account. This vulnerability exposes all users of the application to potential unauthorized access, as the same credentials can be exploited to communicate with the cloud service. The use of hardcoded credentials undermines application security, making it critical for users to update to the latest version to ensure their data integrity and privacy.

References