TI-2019-10161 Aliases CVE-2019-13529 GHSA-wgp7-3rwh-vpgw

Cross-site request forgery in SMA Solar Technology AG Sunny WebBox

HIGH 73CWE-352Published 2019-10-09 · Updated 2026-07-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.03113 87th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SMA Solar Technology AG	Sunny WebBox	Firmware Version 1.6 and prior	—	No fix listed	CNA

Sunny WebBox VendorSMA Solar Technology AG Affected Firmware Version 1.6 and prior Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:sma:sunny_webbox_firmware::::::::	up to 1.6	Vulnerable	SMA
cpe:2.3:h:sma:sunny_webbox:-:::::::*	not specified by NVD	Running on	SMA

cpe:2.3:o:sma:sunny_webbox_firmware:*:*:*:*:*:*:*:* Versions up to 1.6 Vulnerable ·SMA
cpe:2.3:h:sma:sunny_webbox:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SMA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-13529
2026-10-03 Alias added: GHSA-wgp7-3rwh-vpgw

References

Advisory 2

TI-2015-03350 SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote… CVSS 2.0HIGH 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences