CVE-2017-9856: Critical severity sma sunny boy 3600 firmware vulnerability
Published Aug 5, 2017
·Updated
DISPUTED An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algorithm. This enables an attacker to find the plaintext passwords and authenticate to the device. NOTE: the vendor reports that only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected.
Affected Software
156 affected components
SMA Sunny Boy 3600 Firmware
SMA Sunny Boy 3600
SMA Sunny Boy 5000 Firmware
SMA Sunny Boy 5000
SMA Sunny Tripower Core1 Firmware
SMA Sunny Tripower Core1
SMA Sunny Tripower 15000tl Firmware
SMA Sunny Tripower 15000tl
SMA Sunny Tripower 20000tl Firmware
SMA Sunny Tripower 20000tl
SMA Sunny Tripower 25000tl Firmware
SMA Sunny Tripower 25000tl
SMA Sunny Tripower 5000tl Firmware
SMA Sunny Tripower 5000tl
SMA Sunny Tripower 12000tl Firmware
SMA Sunny Tripower 12000tl
SMA Sunny Tripower 60 Firmware
SMA Sunny Tripower 60
SMA Sunny Boy 3000tl Firmware
SMA Sunny Boy 3000tl
SMA Sunny Boy 3600tl Firmware
SMA Sunny Boy 3600tl
SMA Sunny Boy 4000tl Firmware
SMA Sunny Boy 4000tl
SMA Sunny Boy 5000tl Firmware
SMA Sunny Boy 5000tl
SMA Sunny Boy 1.5 Firmware
SMA Sunny Boy 1.5
SMA Sunny Boy 2.5 Firmware
SMA Sunny Boy 2.5
SMA Sunny Boy 3.0 Firmware
SMA Sunny Boy 3.0
SMA Sunny Boy 3.6 Firmware
SMA Sunny Boy 3.6
SMA Sunny Boy 4.0 Firmware
SMA Sunny Boy 4.0
SMA Sunny Boy 5.0 Firmware
SMA Sunny Boy 5.0
SMA Sunny Central 2200 Firmware
SMA Sunny Central 2200
SMA Sunny Central 1000cp Xt Firmware
SMA Sunny Central 1000cp Xt
SMA Sunny Central 800cp Xt Firmware
SMA Sunny Central 800cp Xt
SMA Sunny Central 850cp Xt Firmware
SMA Sunny Central 850cp Xt
SMA Sunny Central 900cp Xt Firmware
SMA Sunny Central 900cp Xt
SMA Sunny Central 500cp Xt Firmware
SMA Sunny Central 500cp Xt
SMA Sunny Central 630cp Xt Firmware
SMA Sunny Central 630cp Xt
SMA Sunny Central 720cp Xt Firmware
SMA Sunny Central 720cp Xt
SMA Sunny Central 760cp Xt Firmware
SMA Sunny Central 760cp Xt
SMA Sunny Central Storage 500 Firmware
SMA Sunny Central Storage 500
SMA Sunny Central Storage 630 Firmware
SMA Sunny Central Storage 630
SMA Sunny Central Storage 720 Firmware
SMA Sunny Central Storage 720
SMA Sunny Central Storage 760 Firmware
SMA Sunny Central Storage 760
SMA Sunny Central Storage 800 Firmware
SMA Sunny Central Storage 800
SMA Sunny Central Storage 850 Firmware
SMA Sunny Central Storage 850
SMA Sunny Central Storage 900 Firmware
SMA Sunny Central Storage 900
SMA Sunny Central Storage 1000 Firmware
SMA Sunny Central Storage 1000
SMA Sunny Central Storage 2200 Firmware
SMA Sunny Central Storage 2200
SMA Sunny Central Storage 2500-ev Firmware
SMA Sunny Central Storage 2500-ev
SMA Sunny Boy Storage 2.5 Firmware
SMA Sunny Boy Storage 2.5
All of the following
SMA Sunny Boy 3600 Firmware
SMA Sunny Boy 3600
All of the following
SMA Sunny Boy 5000
SMA Sunny Boy 5000 Firmware
All of the following
SMA Sunny Tripower Core1
SMA Sunny Tripower Core1 Firmware
All of the following
SMA Sunny Tripower 15000tl
SMA Sunny Tripower 15000tl Firmware
All of the following
SMA Sunny Tripower 20000tl Firmware
SMA Sunny Tripower 20000tl
All of the following
SMA Sunny Tripower 25000tl Firmware
SMA Sunny Tripower 25000tl
All of the following
SMA Sunny Tripower 5000tl Firmware
SMA Sunny Tripower 5000tl
All of the following
SMA Sunny Tripower 12000tl Firmware
SMA Sunny Tripower 12000tl
All of the following
SMA Sunny Tripower 60 Firmware
SMA Sunny Tripower 60
All of the following
SMA Sunny Boy 3000tl Firmware
SMA Sunny Boy 3000tl
All of the following
SMA Sunny Boy 3600tl Firmware
SMA Sunny Boy 3600tl
All of the following
SMA Sunny Boy 4000tl Firmware
SMA Sunny Boy 4000tl
All of the following
SMA Sunny Boy 5000tl Firmware
SMA Sunny Boy 5000tl
All of the following
SMA Sunny Boy 1.5 Firmware
SMA Sunny Boy 1.5
All of the following
SMA Sunny Boy 2.5 Firmware
SMA Sunny Boy 2.5
All of the following
SMA Sunny Boy 3.0 Firmware
SMA Sunny Boy 3.0
All of the following
SMA Sunny Boy 3.6 Firmware
SMA Sunny Boy 3.6
All of the following
SMA Sunny Boy 4.0 Firmware
SMA Sunny Boy 4.0
All of the following
SMA Sunny Boy 5.0 Firmware
SMA Sunny Boy 5.0
All of the following
SMA Sunny Central 2200 Firmware
SMA Sunny Central 2200
All of the following
SMA Sunny Central 1000cp Xt Firmware
SMA Sunny Central 1000cp Xt
All of the following
SMA Sunny Central 800cp Xt Firmware
SMA Sunny Central 800cp Xt
All of the following
SMA Sunny Central 850cp Xt Firmware
SMA Sunny Central 850cp Xt
All of the following
SMA Sunny Central 900cp Xt Firmware
SMA Sunny Central 900cp Xt
All of the following
SMA Sunny Central 500cp Xt Firmware
SMA Sunny Central 500cp Xt
All of the following
SMA Sunny Central 630cp Xt Firmware
SMA Sunny Central 630cp Xt
All of the following
SMA Sunny Central 720cp Xt Firmware
SMA Sunny Central 720cp Xt
All of the following
SMA Sunny Central 760cp Xt Firmware
SMA Sunny Central 760cp Xt
All of the following
SMA Sunny Central Storage 500 Firmware
SMA Sunny Central Storage 500
All of the following
SMA Sunny Central Storage 630 Firmware
SMA Sunny Central Storage 630
All of the following
SMA Sunny Central Storage 720 Firmware
SMA Sunny Central Storage 720
All of the following
SMA Sunny Central Storage 760 Firmware
SMA Sunny Central Storage 760
All of the following
SMA Sunny Central Storage 800 Firmware
SMA Sunny Central Storage 800
All of the following
SMA Sunny Central Storage 850 Firmware
SMA Sunny Central Storage 850
All of the following
SMA Sunny Central Storage 900
SMA Sunny Central Storage 900 Firmware
All of the following
SMA Sunny Central Storage 1000
SMA Sunny Central Storage 1000 Firmware
All of the following
SMA Sunny Central Storage 2200
SMA Sunny Central Storage 2200 Firmware
All of the following
SMA Sunny Central Storage 2500-ev
SMA Sunny Central Storage 2500-ev Firmware
All of the following
SMA Sunny Boy Storage 2.5
SMA Sunny Boy Storage 2.5 Firmware
Event History
Aug 5, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Disputed
05:29 PM
Data Sourced
via NVD·05:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-9856?
The severity of CVE-2017-9856 is considered high due to the ease of decrypting passwords transmitted in SMA Solar Technology products.
2
How do I fix CVE-2017-9856?
To fix CVE-2017-9856, update the SMA Solar Technology firmware to the latest version that addresses this vulnerability.
3
Which SMA Solar products are affected by CVE-2017-9856?
The affected products include various SMA Solar inverters such as the Sunny Boy 3600 and Sunny Tripower models.
4
What type of vulnerability is CVE-2017-9856?
CVE-2017-9856 is a cryptographic weakness where intercepted passwords can be easily decrypted.
5
Can the CVE-2017-9856 vulnerability lead to unauthorized access?
Yes, CVE-2017-9856 can lead to unauthorized access if an attacker successfully decrypts the passwords.