Description
An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SMA | Boy 3.0 | 0.0.0 – < 3.10.27.R | 3.10.27.R |
| SMA | Boy 3.6 | 0.0.0 – < 3.10.27.R | 3.10.27.R |
| SMA | Boy 4.0 | 0.0.0 – < 3.10.27.R | 3.10.27.R |
| SMA | Boy 5.0 | 0.0.0 – < 3.10.27.R | 3.10.27.R |
| SMA | Boy 6.0 | 0.0.0 – < 3.10.27.R | 3.10.27.R |
Advisories 1
- VDE-2025-066 SMA: Directory Traversal in Sunny Boy CERT@VDE · Aug 27, 2025