Read the docs
TI-2025-27648 Aliases CVE-2025-41685GHSA-gv9g-f735-vc63

SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user

Priority LOW 29CWE-359Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-359.

Summary

A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed ennexos.sunnyportal.com (SMA): 15.08.2025

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SMAennexos.sunnyportal.combefore 15.08.202515.08.2025Patch availableCNA
  • ennexos.sunnyportal.com VendorSMA Affected before 15.08.2025 Fixed in 15.08.2025 Patch available CNA

Remediation

  • Fix · CNA ennexos.sunnyportal.com (SMA) Fixed in 15.08.2025

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41685
  2. 2026-10-03 Alias added: GHSA-gv9g-f735-vc63

References

Other 1

  • TI-2019-10161 Cross-site request forgery in SMA Solar Technology AG Sunny WebBox CVSS 3.1HIGH 8.8
  • TI-2021-21218 Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads… CVSS 3.1HIGH 8.1
  • TI-2017-07230 An issue was discovered in SMA Solar Technology products. CVSS 3.0CRITICAL 9.8
  • TI-2017-07225 An issue was discovered in SMA Solar Technology products. CVSS 3.1CRITICAL 9.8
  • TI-2017-07231 An issue was discovered in SMA Solar Technology products. CVSS 3.0CRITICAL 9.8
  • TI-2017-07223 An issue was discovered in SMA Solar Technology products. CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences