SSL Certificate Validation Issue in SunGrow iSolarCloud Android App
CVE-2024-50691

7.4HIGH

Key Information:

Vendor

SunGrow

Status
iSolarCloud Android App
Vendor
CVE Published:
26 February 2025

What is CVE-2024-50691?

The SunGrow iSolarCloud Android app exhibits a critical flaw due to missing SSL certificate validation. This vulnerability allows attackers to perform Man-in-the-Middle (MiTM) attacks by impersonating the iSolarCloud server. Consequently, the app disregards any certificate errors, putting sensitive user data at risk of interception. Users of the iSolarCloud app are advised to update to the latest version to mitigate this risk.

References

https://en.sungrowpower.com/security-notice-detail-2/6124

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-50691 : SSL Certificate Validation Issue in SunGrow iSolarCloud Android App