CVE-2024-50688

Name of the Vulnerable Software and Affected Versions SunGrow iSolarCloud Android application versions V2.1.6.20241017 and prior

Description The issue concerns hardcoded credentials in the SunGrow iSolarCloud Android application. Specifically, the application and the cloud use the same MQTT credentials for exchanging device telemetry, regardless of the user account.

Recommendations For versions V2.1.6.20241017 and prior, consider restricting access to the MQTT credentials until a patch is available. As a temporary workaround, avoid using the hardcoded credentials in the affected application.