Skip to content
OpenAdvisories
Medium · 6.9 CVE-2025-52586 EUVD-2025-23994GHSA-g8qx-jhjm-3f9h

EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information

Published Aug 8, 2025 · Updated Sep 8, 2025 · Assigned by icscert

Description

The MOD3 command traffic between the monitoring application and the
inverter is transmitted in plaintext without encryption or obfuscation.
This vulnerability may allow an attacker with access to a local network
to intercept, manipulate, replay, or forge critical data, including
read/write operations for voltage, current, and power configuration,
operational status, alarms, telemetry, system reset, or inverter control
commands, potentially disrupting power generation or reconfiguring
inverter settings.

Affected products

VendorProductAffectedFixed
EG4 Electronics EG4 12kPV all versions —
EG4 Electronics EG4 18kPV all versions —
EG4 Electronics EG4 Flex 21 all versions —
EG4 Electronics EG4 Flex 18 all versions —
EG4 Electronics EG4 6000XP all versions —
EG4 Electronics EG4 12000XP all versions —
EG4 Electronics EG4 GridBoss all versions —

Advisories 1

References