Summary
A security researcher discovered a privilege escalation vulnerability in the demo system area of the SMA Classic Portal, www.sunnyportal.com.
Only systems of other users have been affected who unintendedly and illicitly had added their non-demo systems to the demo system area.
Details
Impact
An unauthenticated attacker could get access to systems within the demo-system area. Limited to the demo-systems provided there the attacker could change parameters and configuration data. No indicators of compromise have been identified.
Remediation
No action required. The vulnerability was closed in the portal backend on Feb 20th, 2025. A workaround mitigating the impact was implemented on Jan 20th, 2025 immediately after reporting of the issue.
Product Description
Sunny Portal is an online portal for SMA customers to monitor their PV Systems
Vulnerabilities 1
-
High 8.6
SMA: Sunny Portal demo system privilege escalation
An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
Revision history
-
#2
Fix: added distribution
-
#1
Initial revision.
References
-
SMA PSIRT
https://www.sma.de/en/cybersecurity/product-security
-
CERT@VDE Security Advisories for SMA
https://certvde.com/en/advisories/vendor/sma/
-
VDE-2025-010: SMA: Sunny Portal demo system privilege escalation - HTML
https://certvde.com/en/advisories/VDE-2025-010