Skip to content
OpenAdvisories
Medium · 5.4 CVE-2024-11025 EUVD-2024-33982GHSA-jh84-9442-8q99

SMA: SQL injection in Sunny Central UP

Published Nov 27, 2024 · Updated Nov 27, 2024 · Assigned by CERTVDE

Vendor: SMA Product: Sunny Central SC 1760-US Product: Sunny Central SC 1850-US Product: Sunny Central SC 2000 EV-US Product: Sunny Central SC 2000-US Product: Sunny Central SC 2200-US Product: Sunny Central SC 2500 EV-US Product: Sunny Central SC 2660 UP Product: Sunny Central SC 2660 UP-US Product: Sunny Central SC 2750 EV-US Product: Sunny Central SC 2750 UP-US Product: Sunny Central SC 2800 UP Product: Sunny Central SC 2800 UP-US Product: Sunny Central SC 2930 UP Product: Sunny Central SC 2930 UP-US Product: Sunny Central SC 3060 UP Product: Sunny Central SC 3060 UP-US Product: Sunny Central SC 4000 UP Product: Sunny Central SC 4000 UP-US Product: Sunny Central SC 4200 UP Product: Sunny Central SC 4200 UP-US Product: Sunny Central SC 4400 UP Product: Sunny Central SC 4400 UP-JP Product: Sunny Central SC 4400 UP-US Product: Sunny Central SC 4600 UP Product: Sunny Central SC 4600 UP-US Product: Sunny Central SC-2200-10 Product: Sunny Central SC-2475-10 Product: Sunny Central Storage SCS 2300 UP-XT Product: Sunny Central Storage SCS 2300 UP-XT-US Product: Sunny Central Storage SCS 2400 UP-XT Product: Sunny Central Storage SCS 2400 UP-XT-US Product: Sunny Central Storage SCS 2530 UP-XT Product: Sunny Central Storage SCS 2530 UP-XT-US Product: Sunny Central Storage SCS 2630 UP-XT Product: Sunny Central Storage SCS 2630 UP-XT-US Product: Sunny Central Storage SCS 3450 UP Product: Sunny Central Storage SCS 3450 UP-US Product: Sunny Central Storage SCS 3450 UP-XT Product: Sunny Central Storage SCS 3450 UP-XT-JP Product: Sunny Central Storage SCS 3450 UP-XT-US Product: Sunny Central Storage SCS 3600 UP Product: Sunny Central Storage SCS 3600 UP-US Product: Sunny Central Storage SCS 3600 UP-XT Product: Sunny Central Storage SCS 3600 UP-XT-US Product: Sunny Central Storage SCS 3800 UP Product: Sunny Central Storage SCS 3800 UP-US Product: Sunny Central Storage SCS-1900-10 Product: Sunny Central Storage SCS-2200-10 Product: Sunny Central Storage SCS-2475-10 Product: Sunny Central Storage SCS-2900-10

Description

An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.

Affected products

VendorProductAffectedFixed
SMA Sunny Central SC 1760-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 1850-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2000 EV-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2000-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC-2200-10 < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2200-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC-2475-10 < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2500 EV-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2660 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2660 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2750 EV-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2750 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2800 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2800 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2930 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 2930 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 3060 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 3060 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4000 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4000 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4200 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4200 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4400 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4400 UP-JP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4400 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4600 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central SC 4600 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS-1900-10 < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS-2200-10 < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2300 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2300 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2400 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2400 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS-2475-10 < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2530 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2530 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2630 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 2630 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS-2900-10 < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3450 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3450 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3450 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3450 UP-XT-JP < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3450 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3600 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3600 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3600 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3600 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3800 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3800 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3800 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3800 UP-XT-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3950 UP < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3950 UP-US < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3950 UP-XT < 10.01.18.R 10.01.18.R
SMA Sunny Central Storage SCS 3950 UP-XT-US < 10.01.18.R 10.01.18.R

Advisories 1

References