Summary
A security researcher discovered a critical Remote Code Execution vulnerability in sunnyportal.com.
An attacker could upload code instead of an image and remotely execute this code.
Details
Impact
An unauthenticated attacker could upload code instead of an image in the demo section of the portal and can remotely execute this code.
Remediation
No action required. The vulnerability was closed in the portal on December, 19, 2024.
Product Description
Sunny Portal is an online portal for SMA customers to monitor their PV Systems
Vulnerabilities 1
-
Medium 6.5
SMA: Sunny Portal Remote Code Execution
An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.
Revision history
-
#4
Fix: added distribution, quotation mark
-
#3
fixed document status, csaf reference URL
-
#2
Update: Changed Date in Remediation
-
#1
Initial revision.
References
-
SMA PSIRT
https://www.sma.de/en/cybersecurity/product-security
-
CERT@VDE Security Advisories for SMA
https://certvde.com/en/advisories/vendor/sma/
-
VDE-2025-012: SMA: Sunny Portal Remote Code Execution - HTML
https://certvde.com/en/advisories/VDE-2025-012