Skip to content
OpenAdvisories

Vendor

SMA

7 known vulnerabilities.

SMA at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202520
Jul 202500
Jun 202500
May 202510
Apr 202500
Mar 202500
Feb 202510
Jan 202500
Dec 202400

Products

www.sunnyportal.com 2 Sunny Central SC 1760-US 1 Sunny Central SC 1850-US 1 Sunny Central SC 2000 EV-US 1 Sunny Central SC 2000-US 1 Sunny Central SC-2200-10 1 Sunny Central SC 2200-US 1 Sunny Central SC-2475-10 1 Sunny Central SC 2500 EV-US 1 Sunny Central SC 2660 UP 1 Sunny Central SC 2660 UP-US 1 Sunny Central SC 2750 EV-US 1 Sunny Central SC 2750 UP-US 1 Sunny Central SC 2800 UP 1 Sunny Central SC 2800 UP-US 1 Sunny Webbox 1 Sunny Central SC 2930 UP 1 Sunny Central SC 2930 UP-US 1 Sunny Central SC 3060 UP 1 Sunny Central SC 3060 UP-US 1 Sunny Central SC 4000 UP 1 Sunny Central SC 4000 UP-US 1 Sunny Central SC 4200 UP 1 Sunny Central SC 4200 UP-US 1 Sunny Central SC 4400 UP 1 Sunny Central SC 4400 UP-JP 1 Sunny Central SC 4400 UP-US 1 Sunny Central SC 4600 UP 1 Sunny Central SC 4600 UP-US 1 Sunny Central Storage SCS-1900-10 1 Sunny Central Storage SCS-2200-10 1 Sunny Central Storage SCS 2300 UP-XT 1 Sunny Central Storage SCS 2300 UP-XT-US 1 Sunny Central Storage SCS 2400 UP-XT 1 Sunny Central Storage SCS 2400 UP-XT-US 1 Sunny Central Storage SCS-2475-10 1 Sunny Central Storage SCS 2530 UP-XT 1 Sunny Central Storage SCS 2530 UP-XT-US 1 Sunny Central Storage SCS 2630 UP-XT 1 Sunny Central Storage SCS 2630 UP-XT-US 1

Latest advisories

  • Medium max 6.5
    ICSA-25-079-04 1 CVE

    SMA Sunny Portal

    Successful exploitation of this vulnerability could allow an attacker to upload and remotely execute code.

    SMA
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 6.5
    CVE-2021-4459

    SMA: Directory Traversal in Sunny Boy <3.10.27.R

    An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

    SMA Boy 3.0 Boy 4.0 Boy 6.0
  • Medium 6.5
    CVE-2025-41685

    SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user

    A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.

    SMA ennexos.sunnyportal.com
  • High 8.6
    CVE-2025-41645

    SMA: Sunny Portal demo system privilege escalation

    An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.

    SMA www.sunnyportal.com
  • Medium 6.5
    CVE-2025-0731

    SMA: Sunny Portal Remote Code Execution

    An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.

    SMA www.sunnyportal.com
  • Medium 5.4
    CVE-2024-11025

    SMA: SQL injection in Sunny Central UP

    An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.

    SMA Sunny Central Storage SCS 3600 UP-US Sunny Central SC 2800 UP-US Sunny Central Storage SCS 2300 UP-XT
  • Medium 6.4
    CVE-2024-1890

    Clickjacking vulnerability in Sunny Webbox

    Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.

    SMA Sunny Webbox
  • High 8.8
    CVE-2024-1889

    Cross-Site Request Forgery vulnerability in SMA Cluster Controller

    Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected devic…

    SMA SMA Cluster Controller