CVE-2017-9852

Published: Aug 5, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company (but are sometimes changed). Hidden user accounts have (at least in some cases, though more research is required to test this for all hidden user accounts) a fixed password for all devices; it can never be changed by a user. Other vulnerabilities exist that allow an attacker to get the passwords of these hidden user accounts. NOTE: the vendor reports that it has no influence on the allocation of passwords, and that global hardcoded master passwords do not exist. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected

Affected (39)

Sma

39 products

Sunny Boy 3600 Firmware

Sunny Boy 5000 Firmware

Sunny Tripower Core1 Firmware

Sunny Tripower 15000tl Firmware

Sunny Tripower 20000tl Firmware

Sunny Tripower 25000tl Firmware

Sunny Tripower 5000tl Firmware

Sunny Tripower 12000tl Firmware

Sunny Tripower 60 Firmware

Sunny Boy 3000tl Firmware

Sunny Boy 3600tl Firmware

Sunny Boy 4000tl Firmware

Sunny Boy 5000tl Firmware

Sunny Boy 1.5 Firmware

Sunny Boy 2.5 Firmware

Sunny Boy 3.0 Firmware

Sunny Boy 3.6 Firmware

Sunny Boy 4.0 Firmware

Sunny Boy 5.0 Firmware

Sunny Central 2200 Firmware

Sunny Central 1000cp Xt Firmware

Sunny Central 800cp Xt Firmware

Sunny Central 850cp Xt Firmware

Sunny Central 900cp Xt Firmware

Sunny Central 500cp Xt Firmware

Sunny Central 630cp Xt Firmware

Sunny Central 720cp Xt Firmware

Sunny Central 760cp Xt Firmware

Sunny Central Storage 500 Firmware

Sunny Central Storage 630 Firmware

Sunny Central Storage 720 Firmware

Sunny Central Storage 760 Firmware

Sunny Central Storage 800 Firmware

Sunny Central Storage 850 Firmware

Sunny Central Storage 900 Firmware

Sunny Central Storage 1000 Firmware

Sunny Central Storage 2200 Firmware

Sunny Central Storage 2500 Ev Firmware

Sunny Boy Storage 2.5 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 3600 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 3600	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 5000 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 5000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower Core1 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower Core1	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower 15000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower 15000tl	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower 20000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower 20000tl	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower 25000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower 25000tl	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower 5000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower 5000tl	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower 12000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower 12000tl	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Tripower 60 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Tripower 60	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 3000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 3000tl	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 3600tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 3600tl	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 4000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 4000tl	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 5000tl Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 5000tl	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 1.5 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 1.5	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 2.5 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 2.5	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 3.0 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 3.0	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 3.6 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 3.6	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 4.0 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 4.0	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy 5.0 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy 5.0	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 2200 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 2200	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 1000cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 1000cp Xt	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 800cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 800cp Xt	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 850cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 850cp Xt	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 900cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 900cp Xt	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 500cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 500cp Xt	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 630cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 630cp Xt	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 720cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 720cp Xt	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central 760cp Xt Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central 760cp Xt	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 500 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 500	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 630 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 630	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 720 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 720	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 760 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 760	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 800 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 800	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 850 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 850	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 900 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 900	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 1000 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 1000	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 2200 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 2200	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Central Storage 2500 Ev Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Central Storage 2500 Ev	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sma Sunny Boy Storage 2.5 Firmware	All versions

Running on/with	Platform Versions
Sma Sunny Boy Storage 2.5	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (6)

http://www.sma.de/en/statement-on-cyber-security.html

Source: cve@mitre.org

http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf

Source: cve@mitre.org

https://horusscenario.com/CVE-information/

Source: cve@mitre.org

Third Party Advisory

http://www.sma.de/en/statement-on-cyber-security.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

https://horusscenario.com/CVE-information/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.