Summary
A security researcher discovered a data disclosure vulnerability in Sunny Portal powered by ennexOS, ennexos.sunnyportal.com.
A regularly authenticated user can receive the name of an other registered Sunny Portal user by entering the email address of this registered user.
Details
Impact
A regularly authenticated user of Sunny Portal could receive name and surname of other registered users.
Remediation
No action required. The vulnerability was closed in the Sunny Portal powered by ennexOS on August, 15th 2025.
Product Description
Sunny Portal powered by ennexOS is an online portal for SMA customers to monitor their PV Systems
Vulnerabilities 1
-
Medium 6.5
SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user
A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.
Revision history
-
#1
Initial revision.
References
-
SMA PSIRT
https://www.sma.de/en/cybersecurity/product-security
-
CERT@VDE Security Advisories for SMA
https://certvde.com/en/advisories/vendor/sma/
-
VDE-2025-050: SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user - HTML
https://certvde.com/en/advisories/VDE-2025-050