Victor Pasman

HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

Improper privilege management allows a local zammad user to escalate privileges to root.

A session hijack issue allows for remote code execution as the zammad user. Approximately 12,000 instances have been identified globally.

Improper access control in the chunk activity component of the server web-interface allows any created account to read all cracked hashes of a Hashtopolis server instance.

The Accessibility Suite by Ability, Inc plugin for WordPress contains a flaw allowing authenticated attackers with Subscriber-level access or higher to perform SQL Injection. This occurs because the `scan id` parameter is not properly escaped and the SQL query is not sufficiently prepared, enabling the execution of additional queries to extract sensitive information from the database.

The software contains a stored cross site scripting (XSS) issue in the `Plant Name` field. A malicious HTML payload can be displayed on the plant management page through a direct post, potentially allowing an attacker to execute malicious code within a legitimate user's browser. The issue involves the injection of a crafted payload via the `Plant Name` field.

The SWD debug interface on the device is enabled by default. This allows an attacker to gain debug access, potentially enabling the extraction of sensitive information such as secrets or domains stored within the device.

The authentication mechanism on the web interface is flawed, allowing bypass of authentication checks through crafted POST requests with new settings. This is due to the absence of session tokens or authentication measures. An attacker could redirect the device to an arbitrary address for domain name resolution, potentially enabling a man-in-the-middle (MitM) attack. The vulnerability involves crafting a POST request to manipulate settings without proper authentication.

A lack of encryption on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X allows an attacker with network access to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.

The Growatt ShineLan-X communication dongle contains an undocumented backup account with undocumented credentials. This allows significant access to the device, including access to the Setting Center, effectively creating a backdoor for devices utilizing the dongle.

The software contains a stored cross site scripting (XSS) issue within the local configuration web server. An attacker could inject a JavaScript code snippet into the settings center of the communication module. This could lead to the execution of malicious code within a legitimate user's browser.

The firmware for ShineLan-X contains hard-coded credentials for an FTP server, enabling insecure FTP connections. This allows an attacker to replace legitimate files with malicious versions, as firmware signature verification is not enforced.

The SolarEdge SE3680H device has a debug/test interface that is accessible without authentication. This allows unauthorized individuals to view internal system information and execute debug commands.

The SolarEdge SE3680H device exhibits an unauthenticated disclosure of sensitive information during the bootloader loop. During device initialization and while awaiting boot instructions, the bootloader emits diagnostic output, potentially revealing operating system information.

The SolarEdge SE3680H ships with an outdated Linux kernel that has unpatched flaws in core subsystems. An attacker with network or local access could potentially achieve remote code execution, escalate privileges, or disclose sensitive information by exploiting these flaws.

The SolarEdge monitoring platform has a Cross-Site Scripting (XSS) flaw. An authenticated user can inject payloads into report names. These payloads may execute in a victim’s browser when a deletion attempt is made.

The CleverDisplay BlueOne hardware player allows access to the BIOS setup interface by connecting a USB keyboard and pressing ESC during boot after bypassing the device’s physical enclosure. This exposes internal system information, potentially increasing the attack surface. The device is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. The issue does not allow integrity or availability compromise under standard or tested configurations.