Firmware Update Vulnerability in Solax Devices

CVE-2025-15575

What is CVE-2025-15575?

The firmware update feature in Solax devices lacks verification mechanisms, allowing unauthorized firmware files to be installed. This absence of checks, such as digital signature verification, compromises device integrity and security. Additionally, the ESP32's built-in security features, including secure boot, are not being utilized, further increasing the risk of malicious firmware uploads, which can lead to unauthorized control of affected devices.

References