Read the docs
TI-2025-24944 Aliases CVE-2025-36759GHSA-hxwf-q7q4-qgh5

Sensitive Information Disclosure in SolaX Cloud

Priority MEDIUM 44CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and phone numbers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Fixed SolaX Cloud (SolaX Power): 27-06-2025

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SolaX PowerSolaX Cloudbefore 27-06-202527-06-2025Patch availableCNA
  • SolaX Cloud VendorSolaX Power Affected before 27-06-2025 Fixed in 27-06-2025 Patch available CNA

Remediation

  • Fix · CNA SolaX Cloud (SolaX Power) Fixed in 27-06-2025

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-36759
  2. 2026-10-03 Alias added: GHSA-hxwf-q7q4-qgh5

References

Advisory 2

  • TI-2025-14212 Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection CVSS 3.1CRITICAL 9.4
  • TI-2025-24943 Bypass of bruteforce protection in SolaX Cloud CVSS 4.0MEDIUM 6.3
  • TI-2025-24942 Bypass of administrator login screen in SolaX Cloud CVSS 4.0MEDIUM 6.3
  • TI-2025-14213 Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection CVSS 3.1MEDIUM 6.5
  • TI-2025-14214 Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models CVSS 3.1MEDIUM 5.3
  • TI-2025-24941 Device Takeover vulnerability in SolaX Cloud CVSS 4.0MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences