Skip to content
OpenAdvisories
Medium VDE-2025-066 1 CVE

SMA: Directory Traversal in Sunny Boy

Published Aug 27, 2025 · Updated Aug 27, 2025

Vendor: SMA Solar Technology Product: Sunny Boy 3.0 Product: Sunny Boy 3.6 Product: Sunny Boy 4.0 Product: Sunny Boy 5.0 Product: Sunny Boy 6.0

Summary

A security researcher discovered a Directory Traversal vulnerability in Sunny Boy 3, which allows remote attackers to access sensitive information.
The vulnerability is already fixed since January 2021 with version 3.10.27.R.

Details

Impact
An authenticated user can access files and directories outside the intended web root.

Remediation
Update Firmware to at least version 3.10.27.R.

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-4459

    SMA: Directory Traversal in Sunny Boy <3.10.27.R

    An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

    SMA Boy 3.6 Boy 5.0 Boy 3.0

Revision history

  1. #1.0.0

    Initial revision.

References