Skip to content
OpenAdvisories
High ICSA-25-072-12 15 CVEs

Sungrow iSolarCloud Android App, WiNet Firmware

Published Mar 13, 2025 · Updated Mar 13, 2025

Vendor: Sungrow Product: iSolarCloud Android App Product: WiNet Firmware

Summary

Successful exploitation of these vulnerabilities could result in attackers being able to access and could modify sensitive information.

Vulnerabilities 15

  • Critical 9.8
    CVE-2024-50688

    SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (rega…

  • Critical 9.8
    CVE-2024-50694

    In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the unde…

  • Critical 9.8
    CVE-2024-50695

    SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT mes…

  • Critical 9.8
    CVE-2024-50698

    SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks o…

  • Critical 9.1
    CVE-2024-50685

    SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) …

  • Critical 9.1
    CVE-2024-50686

    SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) v…

  • Critical 9.1
    CVE-2024-50687

    SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) v…

  • Critical 9.1
    CVE-2024-50689

    SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) v…

  • Critical 9.1
    CVE-2024-50693

    SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) v…

  • High 8.1
    CVE-2024-50697

    In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific T…

  • High 7.5
    CVE-2024-50696

    SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a spec…

  • High 7.4
    CVE-2024-50691

    SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app expl…

  • Medium 6.5
    CVE-2024-50684

    SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient…

  • Medium 6.5
    CVE-2024-50690

    SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firm…

  • Medium 5.4
    CVE-2024-50692

    SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send…

Revision history

  1. #1

    Initial Publication

References