Description
An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SMA | www.sunnyportal.com | < 19.02.2024 | 19.02.2024 |
Advisories 2
- VDE-2025-012 SMA: Sunny Portal Remote Code Execution CERT@VDE · May 22, 2025
- ICSA-25-079-04 SMA Sunny Portal CISA ICS & IT advisories · Mar 20, 2025