9.8
CRITICAL
CVE-2017-9854
SMA Solar Technology Sunny Explorer Cleartext Password Exposure
Description

An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that exploitation likelihood is low because these packets are usually sent only once during installation. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected

INFO

Published Date :

Aug. 5, 2017, 5:29 p.m.

Last Modified :

Aug. 5, 2024, 6:15 p.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Affected Products

The following products are affected by CVE-2017-9854 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Sma sunny_boy_3600_firmware
2 Sma sunny_boy_5000_firmware
3 Sma sunny_tripower_core1_firmware
4 Sma sunny_tripower_15000tl_firmware
5 Sma sunny_tripower_20000tl_firmware
6 Sma sunny_tripower_25000tl_firmware
7 Sma sunny_tripower_5000tl_firmware
8 Sma sunny_tripower_12000tl_firmware
9 Sma sunny_tripower_60_firmware
10 Sma sunny_boy_3000tl_firmware
11 Sma sunny_boy_3600tl_firmware
12 Sma sunny_boy_4000tl_firmware
13 Sma sunny_boy_5000tl_firmware
14 Sma sunny_boy_1.5_firmware
15 Sma sunny_boy_2.5_firmware
16 Sma sunny_boy_3.0_firmware
17 Sma sunny_boy_3.6_firmware
18 Sma sunny_boy_4.0_firmware
19 Sma sunny_boy_5.0_firmware
20 Sma sunny_central_2200_firmware
21 Sma sunny_central_1000cp_xt_firmware
22 Sma sunny_central_800cp_xt_firmware
23 Sma sunny_central_850cp_xt_firmware
24 Sma sunny_central_900cp_xt_firmware
25 Sma sunny_central_500cp_xt_firmware
26 Sma sunny_central_630cp_xt_firmware
27 Sma sunny_central_720cp_xt_firmware
28 Sma sunny_central_760cp_xt_firmware
29 Sma sunny_central_storage_500_firmware
30 Sma sunny_central_storage_630_firmware
31 Sma sunny_central_storage_720_firmware
32 Sma sunny_central_storage_760_firmware
33 Sma sunny_central_storage_800_firmware
34 Sma sunny_central_storage_850_firmware
35 Sma sunny_central_storage_900_firmware
36 Sma sunny_central_storage_1000_firmware
37 Sma sunny_central_storage_2200_firmware
38 Sma sunny_central_storage_2500-ev_firmware
39 Sma sunny_boy_storage_2.5_firmware
40 Sma sunny_boy_3600
41 Sma sunny_boy_5000
42 Sma sunny_tripower_core1
43 Sma sunny_tripower_15000tl
44 Sma sunny_tripower_20000tl
45 Sma sunny_tripower_25000tl
46 Sma sunny_tripower_5000tl
47 Sma sunny_tripower_12000tl
48 Sma sunny_tripower_60
49 Sma sunny_boy_3000tl
50 Sma sunny_boy_3600tl
51 Sma sunny_boy_4000tl
52 Sma sunny_boy_5000tl
53 Sma sunny_boy_1.5
54 Sma sunny_boy_2.5
55 Sma sunny_boy_3.0
56 Sma sunny_boy_3.6
57 Sma sunny_boy_4.0
58 Sma sunny_boy_5.0
59 Sma sunny_central_2200
60 Sma sunny_central_1000cp_xt
61 Sma sunny_central_800cp_xt
62 Sma sunny_central_850cp_xt
63 Sma sunny_central_900cp_xt
64 Sma sunny_central_500cp_xt
65 Sma sunny_central_630cp_xt
66 Sma sunny_central_720cp_xt
67 Sma sunny_central_760cp_xt
68 Sma sunny_central_storage_500
69 Sma sunny_central_storage_630
70 Sma sunny_central_storage_720
71 Sma sunny_central_storage_760
72 Sma sunny_central_storage_800
73 Sma sunny_central_storage_850
74 Sma sunny_central_storage_900
75 Sma sunny_central_storage_1000
76 Sma sunny_central_storage_2200
77 Sma sunny_central_storage_2500-ev
78 Sma sunny_boy_storage_2.5
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2017-9854.

URL Resource
http://www.sma.de/en/statement-on-cyber-security.html
http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf
https://horusscenario.com/CVE-information/ Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2017-9854 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2017-9854 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    Aug. 05, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    May. 17, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Apr. 11, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Mar. 21, 2024

    Action Type Old Value New Value
    Added Tag MITRE disputed
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Changed Description ** DISPUTED ** An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that exploitation likelihood is low because these packets are usually sent only once during installation. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected. An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that exploitation likelihood is low because these packets are usually sent only once during installation. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
  • CWE Remap by [email protected]

    Oct. 03, 2019

    Action Type Old Value New Value
    Changed CWE CWE-200 CWE-311
  • CVE Modified by [email protected]

    Aug. 22, 2017

    Action Type Old Value New Value
    Changed Description An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. ** DISPUTED ** An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that exploitation likelihood is low because these packets are usually sent only once during installation. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected.
    Added Reference http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf [No Types Assigned]
    Added Reference http://www.sma.de/en/statement-on-cyber-security.html [No Types Assigned]
  • Initial Analysis by [email protected]

    Aug. 15, 2017

    Action Type Old Value New Value
    Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
    Added CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://horusscenario.com/CVE-information/ No Types Assigned https://horusscenario.com/CVE-information/ Third Party Advisory
    Added CWE CWE-200
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_3600_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_3600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_5000_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_5000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_core1_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_core1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_15000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_15000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_20000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_20000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_25000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_25000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_5000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_5000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_12000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_12000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_tripower_60_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_tripower_60:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_3000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_3000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_3600tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_3600tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_4000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_4000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_5000tl_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_5000tl:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_1.5_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_1.5:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_2.5_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_2.5:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_3.0_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_3.0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_3.6_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_3.6:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_4.0_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_4.0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_5.0_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_5.0:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_2200_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_2200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_1000cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_1000cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_800cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_800cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_850cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_850cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_900cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_900cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_500cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_500cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_630cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_630cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_720cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_720cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_760cp_xt_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_760cp_xt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_500_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_630_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_630:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_720_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_720:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_760_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_760:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_800_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_800:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_850_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_850:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_900_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_900:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_1000_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_2200_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_2200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_central_storage_2500-ev_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_central_storage_2500-ev:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:sma:sunny_boy_storage_2.5_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:sma:sunny_boy_storage_2.5:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2017-9854 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.32 }} 0.00%

score

0.65572

percentile

CVSS30 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability