1. EXECUTIVE SUMMARY
- CVSS v4 9.5
- ATTENTION: Exploitable remotely
- Vendor: Sungrow
- Equipment: iSolarCloud Android App, WiNet Firmware
- Vulnerabilities: Improper Certificate Validation, Use of a Broken or Risky Cryptographic Algorithm, Authorization Bypass Through User-Controlled Key, Use of Hard-Coded Credentials, Stack-Based Buffer Overflow, Heap-Based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in attackers being able to access and modify sensitive information. The implications of these vulnerabilities extend beyond individual user accounts, potentially affecting the integrity and availability of critical infrastructure systems, particularly in the energy sector where Sungrow operates.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Sungrow software products are affected:
- iSolarCloud Android App: Version 2.1.6 and prior
- WiNet Firmware: All versions
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER CERTIFICATE VALIDATION CWE-295
The Android app for iSolarCloud explicitly ignores certificate errors, making it vulnerable to adversary-in-the-middle attacks. This vulnerability allows an attacker to impersonate the iSolarCloud server and communicate with the Android app, potentially leading to unauthorized access to user data.
CVE-2024-50691 has been assigned to this vulnerability, with a CVSS v3.1 base score of 6.5 and a CVSS v4 score of 8.3.
3.2.2 USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327
The iSolarCloud Android application uses an insecure AES key for encrypting client data, which may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud. This vulnerability is assigned CVE-2024-50684, with a CVSS v3.1 base score of 6.5 and a CVSS v4 score of 8.3.
3.2.3 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639
The iSolarCloud API is vulnerable to multiple insecure direct object references (IDOR) via the powerStationService API model, allowing unauthorized access to user data. This vulnerability is documented as CVE-2024-50685, with a CVSS v3.1 base score of 6.5 and a CVSS v4 score of 6.9.
3.2.4 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639
Similar to the previous vulnerability, the Solar iCloud API is also vulnerable to IDOR via the userService API model, which may allow unauthorized access to user data. This vulnerability is assigned CVE-2024-50693, with a CVSS v3.1 base score of 8.2 and a CVSS v4 score of 9.2.
3.2.5 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639
The Solar iCloud API is also vulnerable to IDOR via the orgService API model, allowing unauthorized access to user data. This vulnerability is documented as CVE-2024-50689, with a CVSS v3.1 base score of 8.2 and a CVSS v4 score of 9.2.
3.2.6 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639
The Solar iCloud API is vulnerable to IDOR via the commonService API model, which may allow unauthorized access to user data. This vulnerability is assigned CVE-2024-50686, with a CVSS v3.1 base score of 5.3 and a CVSS v4 score of 6.9.
3.2.7 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639
The Solar iCloud API is vulnerable to IDOR via the devService API model, allowing unauthorized access to user data. This vulnerability is documented as CVE-2024-50687, with a CVSS v3.1 base score of 5.3 and a CVSS v4 score of 6.9.
