Read the docs

SMA

Records23All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

SMA records in CISA KEV

No SMA vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Sunny Boy 1.5 Firmware 12 records MEDIUM Sunny Boy 2.5 Firmware 12 records MEDIUM Sunny Boy 3.0 Firmware 12 records MEDIUM Sunny Boy 3.6 Firmware 12 records MEDIUM Sunny Boy 3000tl Firmware 12 records MEDIUM Sunny Boy 3600 Firmware 12 records MEDIUM Sunny Boy 3600tl Firmware 12 records MEDIUM Sunny Boy 4.0 Firmware 12 records MEDIUM

Records

23 records

TI-2019-10161 CVE-2019-13529 · GHSA-wgp7-3rwh-vpgw

Cross-site request forgery in SMA Solar Technology AG Sunny WebBox

Priority HIGH 73

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03113 Published 2019-10-09 No fix listed CWE-352
TI-2025-27611 CVE-2025-41645 · GHSA-6w7j-pwh6-f5f5

SMA: Sunny Portal demo system privilege escalation

Priority MEDIUM 44

An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00423 Published 2025-05-13 Fixed in 20.02.2025 CWE-669
TI-2024-01758 CVE-2024-1889 · GHSA-rg8h-4g25-hj75

Cross-site request forgery in SMA Cluster Controller

Priority MEDIUM 40

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00305 Published 2024-02-26 No fix listed CWE-352
TI-2025-00622 CVE-2025-0731

SMA: Sunny Portal Remote Code Execution

Priority LOW 36

An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00725 Published 2025-02-26 Fixed in 19.02.2024 CWE-434
TI-2021-03315 CVE-2021-4459 · GHSA-qm93-m2hc-9vjf

SMA: Directory Traversal in Sunny Boy <3.10.27.R

Priority LOW 30

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00671 Published 2025-08-27 Fixed in 3.10.27.R CWE-23
TI-2024-01759 CVE-2024-1890 · GHSA-mgvp-6fwh-58v2

Clickjacking vulnerability in Sunny Webbox

Priority LOW 29

Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.

CVSS 3.1MEDIUM 6.4 Network No auth User interaction EPSS 0.00476 Published 2024-02-26 No fix listed CWE-1021
TI-2024-10215 CVE-2024-11025 · GHSA-jh84-9442-8q99

SMA: SQL injection in Sunny Central UP

Priority LOW 24

An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00243 Published 2024-11-27 Fixed in 10.01.18.R CWE-89
Open these records in search →