Skip to content
OpenAdvisories
Medium VDE-2024-075 1 CVE

SMA: Sunny Webbox clickjacking vulnerability

Published Jan 27, 2025 · Updated Jun 17, 2025 · Revision 3

Vendor: SMA Solar Technology Product: SMA Sunny Webbox Product: SMA Sunny Webbox with Bluetooth

Summary

A security researcher discovered that in the affected products a clickjacking vulnerability in the web frontend exists. An attacker could lure the user to click on a malicious website which seems to be the WebUI of the affected product. The affected products are out of support (End-of-Life 2015-12-31).

Details

Impact
A user can be tricked into unwanted actions on other systems while he expects to click on the Webbox WebUI.

Mitigation
If you can not replace your Webbox by a suitable up-to-date product then isolate the affected network segment by blocking all incoming network traffic. Especially never configure your network to allow a port forwarding to SMA Webbox.

Remediation
Replace out-of-support Sunny Webbox / Sunny Webbox with Bluetooth to a suitable up-to-date product. Please note technical information on the switchover to be found at https://www.sma-sunny.com/en/how-to-replace-old-data-logger/

Vulnerabilities 1

  • Medium 6.4
    CVE-2024-1890

    Clickjacking vulnerability in Sunny Webbox

    Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.

    SMA Sunny Webbox

Revision history

  1. #2.0.1

    fixed typo: Got 'vers:all/* ', expected 'vers:all/*', switched to semver versioning scheme

  2. #2.0.0

    Fix: corrected self-reference

  3. #1.0.0

    Initial revision.

References