Firmware Update Vulnerability in SunGrow WiNet-S Connectivity Products
CVE-2024-50696

7.5HIGH

Key Information:

Vendor

SunGrow

Status
WiNet-S
Vendor
CVE Published:
26 February 2025

What is CVE-2024-50696?

The absence of integrity checks for firmware upgrades in SunGrow WiNet-S V200.001.00.P025 and earlier versions presents a significant security risk. Attackers can exploit this vulnerability by transmitting a specially crafted MQTT message, enabling unauthorized firmware updates on inverters or WiNet connectivity dongles. These bogus firmware files can be hosted on servers under the attacker's control, compromising device integrity and functionality.

References

https://en.sungrowpower.com/security-notice-detail-2/6140

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2024-50696 : Firmware Update Vulnerability in SunGrow WiNet-S Connectivity Products