9.8

CVE-2017-9859

An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline crackers. This cracked password can then be used to register at the SMA servers. NOTE: the vendor's position is that "we consider the probability of the success of such manipulation to be extremely low." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sma ≫ Sunny Boy 3600 Firmware Version -
   Sma ≫ Sunny Boy 3600 Version -
Sma ≫ Sunny Boy 5000 Firmware Version -
   Sma ≫ Sunny Boy 5000 Version -
Sma ≫ Sunny Tripower Core1 Firmware Version -
   Sma ≫ Sunny Tripower Core1 Version -
Sma ≫ Sunny Tripower 5000tl Firmware Version -
   Sma ≫ Sunny Tripower 5000tl Version -
Sma ≫ Sunny Tripower 60 Firmware Version -
   Sma ≫ Sunny Tripower 60 Version -
Sma ≫ Sunny Boy 3000tl Firmware Version -
   Sma ≫ Sunny Boy 3000tl Version -
Sma ≫ Sunny Boy 3600tl Firmware Version -
   Sma ≫ Sunny Boy 3600tl Version -
Sma ≫ Sunny Boy 4000tl Firmware Version -
   Sma ≫ Sunny Boy 4000tl Version -
Sma ≫ Sunny Boy 5000tl Firmware Version -
   Sma ≫ Sunny Boy 5000tl Version -
Sma ≫ Sunny Boy 1.5 Firmware Version -
   Sma ≫ Sunny Boy 1.5 Version -
Sma ≫ Sunny Boy 2.5 Firmware Version -
   Sma ≫ Sunny Boy 2.5 Version -
Sma ≫ Sunny Boy 3.0 Firmware Version -
   Sma ≫ Sunny Boy 3.0 Version -
Sma ≫ Sunny Boy 3.6 Firmware Version -
   Sma ≫ Sunny Boy 3.6 Version -
Sma ≫ Sunny Boy 4.0 Firmware Version -
   Sma ≫ Sunny Boy 4.0 Version -
Sma ≫ Sunny Boy 5.0 Firmware Version -
   Sma ≫ Sunny Boy 5.0 Version -
Sma ≫ Sunny Central 2200 Firmware Version -
   Sma ≫ Sunny Central 2200 Version -
Sma ≫ Sunny Boy Storage 2.5 Firmware Version -
   Sma ≫ Sunny Boy Storage 2.5 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.13% 0.621
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-327 Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

http://www.sma.de/en/statement-on-cyber-security.html
http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf
https://horusscenario.com/CVE-information/
Third Party Advisory