Skip to content
OpenAdvisories
High ICSA-25-219-07 4 CVEs

EG4 Electronics EG4 Inverters (Update B)

Published Aug 7, 2025 · Updated Sep 9, 2025 · Revision 3

Vendor: EG4 Electronics Product: EG4 12000XP Product: EG4 12kPV Product: EG4 18kPV Product: EG4 6000XP Product: EG4 Flex 18 Product: EG4 Flex 21 Product: EG4 GridBoss

Summary

Successful exploitation of these vulnerabilities could allow an attacker to intercept and manipulate critical data, install malicious firmware, hijack device access, and gain unauthorized control over the system.

Vulnerabilities 4

  • High 8.8
    CVE-2025-53520

    EG4 Electronics EG4 Inverters Download of Code Without Integrity Check

    The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without int…

    EG4 Electronics EG4 12000XP EG4 12kPV EG4 Flex 21
  • High 8.1
    CVE-2025-46414

    EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts

    The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides…

    EG4 Electronics EG4 GridBoss EG4 18kPV EG4 Flex 18
  • Medium 6.9
    CVE-2025-52586

    EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information

    The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge crit…

    EG4 Electronics EG4 12000XP EG4 12kPV EG4 Flex 21
  • Medium 5.8
    CVE-2025-47872

    EG4 Electronics EG4 Inverters Observable Discrepancy

    The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numbers are sequentially as…

    EG4 Electronics EG4 GridBoss EG4 18kPV EG4 Flex 18

Revision history

  1. #3

    Update B - Added mitigation details for both CVE-2025-53520 and CVE-2025-52586.

  2. #2

    Update A - Updated mitigation details for CVE-2025-47872. Added two additional researchers.

  3. #1

    Initial Publication

References