SolaX Power

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

SolaX Power records in CISA KEV

No SolaX Power vulnerabilities are listed in CISA KEV.

Records

7 records

TI-2025-14212 CVE-2025-15573 · GHSA-xp29-43pm-7r9g

Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

HIGH 80

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883).

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00229 Published 2026-02-12 Fixed in 3.022.03, 1.009.02 +3 CWE-295

TI-2025-24944 CVE-2025-36759 · GHSA-hxwf-q7q4-qgh5

Sensitive Information Disclosure in SolaX Cloud

MEDIUM 44

Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and phone numbers.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00334 Published 2025-09-10 Fixed in 27-06-2025 CWE-200

TI-2025-24943 CVE-2025-36758 · GHSA-rvgf-r637-rxv5

Bypass of bruteforce protection in SolaX Cloud

LOW 34

It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality as an oracle.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00391 Published 2025-09-10 Fixed in 27-06-2025 CWE-307

TI-2025-24942 CVE-2025-36757 · GHSA-v72q-pq8g-gcmw

Bypass of administrator login screen in SolaX Cloud

LOW 34

It is possible to bypass the administrator login screen on SolaX Cloud.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00336 Published 2025-09-10 Fixed in 27-06-2025 CWE-306

TI-2025-14213 CVE-2025-15574 · GHSA-rmgp-99fm-wv32

Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection

LOW 34

When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00205 Published 2026-02-12 Fixed in 3.022.03, 1.009.02 +3 CWE-330

TI-2025-14214 CVE-2025-15575 · GHSA-4gx8-h22x-pf65

Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models

LOW 29

The firmware update functionality does not verify the authenticity of the supplied firmware update files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00143 Published 2026-02-12 Fixed in 3.022.03, 1.009.02 +3 CWE-494

TI-2025-24941 CVE-2025-36756 · GHSA-5jwf-gxj6-4f88

Device Takeover vulnerability in SolaX Cloud

LOW 26

A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.0028 Published 2025-09-10 Fixed in 27-06-2025 CWE-306

Open these records in search →

Critical	1
High	1
Medium	5
Low	0
No CVSS	0