1. Home
  2. CVE Database
  3. CVE-2017-9856
LOW · 3.4

CVE-2017-9856

An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algo...

Vulnerability Description

An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algorithm. This enables an attacker to find the plaintext passwords and authenticate to the device. NOTE: the vendor reports that only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected

CVSS Score

3.4

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
SmaSunny Boy 3600 Firmware-
SmaSunny Boy 3600-
SmaSunny Boy 5000 Firmware-
SmaSunny Boy 5000-
SmaSunny Tripower Core1 Firmware-
SmaSunny Tripower Core1-
SmaSunny Tripower 15000Tl Firmware-
SmaSunny Tripower 15000Tl-
SmaSunny Tripower 20000Tl Firmware-
SmaSunny Tripower 20000Tl-
SmaSunny Tripower 25000Tl Firmware-
SmaSunny Tripower 25000Tl-
SmaSunny Tripower 5000Tl Firmware-
SmaSunny Tripower 5000Tl-
SmaSunny Tripower 12000Tl Firmware-
SmaSunny Tripower 12000Tl-
SmaSunny Tripower 60 Firmware-
SmaSunny Tripower 60-
SmaSunny Boy 3000Tl Firmware-
SmaSunny Boy 3000Tl-

Related Weaknesses (CWE)

CWE-256

References

FAQ

What is CVE-2017-9856?

CVE-2017-9856 is a vulnerability with a CVSS score of 3.4 (LOW). An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algo...

How severe is CVE-2017-9856?

CVE-2017-9856 has been rated LOW with a CVSS base score of 3.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-9856?

Check the references section above for vendor advisories and patch information. Affected products include: Sma Sunny Boy 3600 Firmware, Sma Sunny Boy 3600, Sma Sunny Boy 5000 Firmware, Sma Sunny Boy 5000, Sma Sunny Tripower Core1 Firmware.