SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands…

published 2025-01-24 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-44591

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT communications are vulnerable to MitM attacks at the TCP/IP level.

Patch / fix

fixed in 1

sungrowpower winet-s_firmware 200.001.00.p027

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-072-12 updated 2025-03-13 cvss 8.1

Sungrow iSolarCloud Android App, WiNet Firmware

Sungrow iSolarCloud Android App <=2.1.6 Sungrow WiNet Firmware
affected: vendor fix, mitigation “For more information refer to Sungrow's security notice.” en.sungrowpower.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-27)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

mqtt-pwn.readthedocs.io https://mqtt-pwn.readthedocs.io/en/latest/intro.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

mqtt-pwn.readthedocs.io /en/latest/intro.html
exploit, product
en.sungrowpower.com /security-notice-detail-2/5961
vendor-advisory

Sources

CVE List CVE-2024-50692
NVD CVE-2024-50692

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary