Description
The affected product does not limit the number of attempts for inputting
the correct PIN for a registered product, which may allow an attacker
to gain unauthorized access using brute-force methods if they possess a
valid device serial number. The API provides clear feedback when the
correct PIN is entered. This vulnerability was patched in a server-side
update on April 6, 2025.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EG4 Electronics | EG4 12kPV | all versions | — |
| EG4 Electronics | EG4 18kPV | all versions | — |
| EG4 Electronics | EG4 Flex 21 | all versions | — |
| EG4 Electronics | EG4 Flex 18 | all versions | — |
| EG4 Electronics | EG4 6000XP | all versions | — |
| EG4 Electronics | EG4 12000XP | all versions | — |
| EG4 Electronics | EG4 GridBoss | all versions | — |
Advisories 1
- ICSA-25-219-07 EG4 Electronics EG4 Inverters (Update B) CISA ICS & IT advisories · Sep 9, 2025