Humza Ahmad

Name of the Vulnerable Software and Affected Versions: SolaX Cloud platform (affected versions not specified) Description: A missing authorization issue exists on the SolaX Cloud platform. This allows unauthorized access and potential takeover of SolaX solar panel inverters when the serial number is known. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SolaX Cloud (affected versions not specified) Description: It is possible to bypass the administrator login screen. An attacker could use parameter tampering to bypass the login screen and gain limited access to the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SolaX Cloud (affected versions not specified) Description: It is possible to bypass the clipping level of authentication attempts through the 'Forgot Password' functionality, acting as an oracle. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SolaX Cloud versions prior to 27-06-2025 Description: SolaX Cloud leaks sensitive information, such as user email addresses and phone numbers, by suggesting similar user accounts when user names are provided. This information disclosure poses a risk of phishing attacks and potential GDPR fines. Recommendations: Restrict access to SolaX Cloud prior to version 27-06-2025. Monitor SolaX Cloud instances for unauthorized access attempts prior to version 27-06-2025.

An incorrect authorisation check exists in the 'plant transfer' function. This allows a malicious attacker with a valid account to transfer any plant into their account.

The issue is related to multiple buffer overflows in the MMS Client of MZ Automation LibIEC61850. A malicious server can cause a stack-based buffer overflow via the MMS IdentifyResponse message, potentially leading to remote code execution and system compromise.

A NULL pointer dereference in the MMS Client of MZ Automation LibIEC1850 allows a malicious server to cause a Denial-of-Service via the MMS InitiationResponse message. This issue can be exploited by a malicious server, leading to a denial-of-service condition.