CVE-2019-19228

Published: Dec 4, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.

Affected (66)

Products: Fronius: Datamanager Box 2.0 Firmware, Eco 25.0 3 S Firmware, Eco 27.0 3 S Firmware, Galvo 1.5 1 Firmware, Galvo 1.5 1 208 240 Firmware, Galvo 2.0 1 Firmware, Galvo 2.0 1 208 240 Firmware, Galvo 2.5 1 Firmware, Galvo 2.5 1 208 240 Firmware, Galvo 3.0 1 Firmware, Galvo 3.1 1 Firmware, Galvo 3.1 1 208 240 Firmware, Primo 10.0 1 208 240 Firmware, Primo 11.4 1 208 240 Firmware, Primo 12.5 1 208 240 Firmware, Primo 15.0 1 208 240 Firmware, Primo 3.0 1 Firmware, Primo 3.5 1 Firmware, Primo 3.6 1 Firmware, Primo 3.8 1 208 240 Firmware, Primo 4.0 1 Firmware, Primo 4.6 1 Firmware, Primo 5.0 1 Firmware, Primo 5.0 1 208 240 Firmware, Primo 5.0 1 Aus Firmware, Primo 5.0 1 Sc Firmware, Primo 6.0 1 Firmware, Primo 6.0 1 208 240 Firmware, Primo 7.6 1 208 240 Firmware, Primo 8.2 1 Firmware, Primo 8.2 1 208 240 Firmware, Symo 10.0 3 M Firmware, Symo 10.0 3 M Os Firmware, Symo 10.0 3 208 240 Firmware, Symo 10.0 3 480 Firmware, Symo 12.0 3 208 240 Firmware, Symo 12.5 3 M Firmware, Symo 12.5 3 480 Firmware, Symo 15.0 3 M Firmware, Symo 15.0 3 107 Firmware, Symo 15.0 3 480 Firmware, Symo 17.5 3 M Firmware, Symo 17.5 3 480 Firmware, Symo 20.0 3 M Firmware, Symo 20.0 3 480 Firmware, Symo 22.7 3 480 Firmware, Symo 24.0 3 480 Firmware, Symo 3.0 3 M Firmware, Symo 3.0 3 S Firmware, Symo 3.7 3 M Firmware, Symo 3.7 3 S Firmware, Symo 4.5 3 M Firmware, Symo 4.5 3 S Firmware, Symo 5.0 3 M Firmware, Symo 6.0 3 M Firmware, Symo 7.0 3 M Firmware, Symo 8.2 3 M Firmware, Symo Advanced 10.0 3 208 240 Firmware, Symo Advanced 12.0 3 208 240 Firmware, Symo Advanced 15.0 3 480 Firmware, Symo Advanced 20.0 3 480 Firmware, Symo Advanced 22.7 3 480 Firmware, Symo Advanced 24.0 3 480 Firmware, Symo Hybrid 3.0 3 M Firmware, Symo Hybrid 4.0 3 M Firmware, Symo Hybrid 5.0 3 M Firmware

Fronius

66 products

Datamanager Box 2.0 Firmware

Eco 25.0 3 S Firmware

Eco 27.0 3 S Firmware

Galvo 1.5 1 Firmware

Galvo 1.5 1 208 240 Firmware

Galvo 2.0 1 Firmware

Galvo 2.0 1 208 240 Firmware

Galvo 2.5 1 Firmware

Galvo 2.5 1 208 240 Firmware

Galvo 3.0 1 Firmware

Galvo 3.1 1 Firmware

Galvo 3.1 1 208 240 Firmware

Primo 10.0 1 208 240 Firmware

Primo 11.4 1 208 240 Firmware

Primo 12.5 1 208 240 Firmware

Primo 15.0 1 208 240 Firmware

Primo 3.0 1 Firmware

Primo 3.5 1 Firmware

Primo 3.6 1 Firmware

Primo 3.8 1 208 240 Firmware

Primo 4.0 1 Firmware

Primo 4.6 1 Firmware

Primo 5.0 1 Firmware

Primo 5.0 1 208 240 Firmware

Primo 5.0 1 Aus Firmware

Primo 5.0 1 Sc Firmware

Primo 6.0 1 Firmware

Primo 6.0 1 208 240 Firmware

Primo 7.6 1 208 240 Firmware

Primo 8.2 1 Firmware

Primo 8.2 1 208 240 Firmware

Symo 10.0 3 M Firmware

Symo 10.0 3 M Os Firmware

Symo 10.0 3 208 240 Firmware

Symo 10.0 3 480 Firmware

Symo 12.0 3 208 240 Firmware

Symo 12.5 3 M Firmware

Symo 12.5 3 480 Firmware

Symo 15.0 3 M Firmware

Symo 15.0 3 107 Firmware

Symo 15.0 3 480 Firmware

Symo 17.5 3 M Firmware

Symo 17.5 3 480 Firmware

Symo 20.0 3 M Firmware

Symo 20.0 3 480 Firmware

Symo 22.7 3 480 Firmware

Symo 24.0 3 480 Firmware

Symo 3.0 3 M Firmware

Symo 3.0 3 S Firmware

Symo 3.7 3 M Firmware

Symo 3.7 3 S Firmware

Symo 4.5 3 M Firmware

Symo 4.5 3 S Firmware

Symo 5.0 3 M Firmware

Symo 6.0 3 M Firmware

Symo 7.0 3 M Firmware

Symo 8.2 3 M Firmware

Symo Advanced 10.0 3 208 240 Firmware

Symo Advanced 12.0 3 208 240 Firmware

Symo Advanced 15.0 3 480 Firmware

Symo Advanced 20.0 3 480 Firmware

Symo Advanced 22.7 3 480 Firmware

Symo Advanced 24.0 3 480 Firmware

Symo Hybrid 3.0 3 M Firmware

Symo Hybrid 4.0 3 M Firmware

Symo Hybrid 5.0 3 M Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Datamanager Box 2.0 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Datamanager Box 2.0	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Eco 25.0 3 S Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Eco 25.0 3 S	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Eco 27.0 3 S Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Eco 27.0 3 S	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 1.5 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 1.5 1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 1.5 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 1.5 1 208 240	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 2.0 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 2.0 1	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 2.0 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 2.0 1 208 240	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 2.5 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 2.5 1	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 2.5 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 2.5 1 208 240	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 3.0 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 3.0 1	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 3.1 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 3.1 1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Galvo 3.1 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Galvo 3.1 1 208 240	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 10.0 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 10.0 1 208 240	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 11.4 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 11.4 1 208 240	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 12.5 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 12.5 1 208 240	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 15.0 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 15.0 1 208 240	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 3.0 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 3.0 1	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 3.5 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 3.5 1	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 3.6 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 3.6 1	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 3.8 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 3.8 1 208 240	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 4.0 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 4.0 1	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 4.6 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 4.6 1	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 5.0 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 5.0 1	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 5.0 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 5.0 1 208 240	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 5.0 1 Aus Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 5.0 1 Aus	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 5.0 1 Sc Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 5.0 1 Sc	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 6.0 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 6.0 1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 6.0 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 6.0 1 208 240	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 7.6 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 7.6 1 208 240	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 8.2 1 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 8.2 1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Primo 8.2 1 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Primo 8.2 1 208 240	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 10.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 10.0 3 M	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 10.0 3 M Os Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 10.0 3 M Os	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 10.0 3 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 10.0 3 208 240	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 10.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 10.0 3 480	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 12.0 3 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 12.0 3 208 240	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 12.5 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 12.5 3 M	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 12.5 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 12.5 3 480	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 15.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 15.0 3 M	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 15.0 3 107 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 15.0 3 107	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 15.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 15.0 3 480	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 17.5 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 17.5 3 M	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 17.5 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 17.5 3 480	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 20.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 20.0 3 M	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 20.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 20.0 3 480	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 22.7 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 22.7 3 480	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 24.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 24.0 3 480	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 3.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 3.0 3 M	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 3.0 3 S Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 3.0 3 S	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 3.7 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 3.7 3 M	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 3.7 3 S Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 3.7 3 S	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 4.5 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 4.5 3 M	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 4.5 3 S Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 4.5 3 S	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 5.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 5.0 3 M	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 6.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 6.0 3 M	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 7.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 7.0 3 M	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo 8.2 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo 8.2 3 M	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Advanced 10.0 3 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Advanced 10.0 3 208 240	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Advanced 12.0 3 208 240 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Advanced 12.0 3 208 240	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Advanced 15.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Advanced 15.0 3 480	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Advanced 20.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Advanced 20.0 3 480	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Advanced 22.7 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Advanced 22.7 3 480	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Advanced 24.0 3 480 Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Advanced 24.0 3 480	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Hybrid 3.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Hybrid 3.0 3 M	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Hybrid 4.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Hybrid 4.0 3 M	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fronius Symo Hybrid 5.0 3 M Firmware	Before 3.14.1

Running on/with	Platform Versions
Fronius Symo Hybrid 5.0 3 M	All versions

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (6)

http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/

Source: cve@mitre.org

ExploitThird Party Advisory

https://seclists.org/bugtraq/2019/Dec/5

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://seclists.org/bugtraq/2019/Dec/5

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

Timeline

No history available yet.