CVE-2024-50694

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50694
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://en.sungrowpower.com/security-notice-detail-2/5961 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sungrowpower:winet-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:sungrowpower:winet-s:-:*:*:*:*:*:*:*
History

29 May 2025, 16:02

Type Values Removed Values Added
References () https://en.sungrowpower.com/security-notice-detail-2/5961 - () https://en.sungrowpower.com/security-notice-detail-2/5961 - Vendor Advisory
CPE cpe:2.3:o:sungrowpower:winet-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:sungrowpower:winet-s:-:*:*:*:*:*:*:*
First Time Sungrowpower
Sungrowpower winet-s
Sungrowpower winet-s Firmware

05 Feb 2025, 15:15

Type Values Removed Values Added
CWE CWE-121
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary
  • (es) En SunGrow WiNet-SV200.001.00.P027 y versiones anteriores, al copiar la lectura timestamp de un mensaje MQTT, el código subyacente no comprueba los límites del búfer que se utiliza para almacenar el mensaje. Esto puede provocar un desbordamiento del búfer basado en la pila.

24 Jan 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-24 23:15

Updated : 2025-05-29 16:02

NVD link : CVE-2024-50694

Mitre link : CVE-2024-50694

CVE.ORG link : CVE-2024-50694

JSON object : View

Products Affected

sungrowpower

  • winet-s
  • winet-s_firmware
CWE
CWE-121

Stack-based Buffer Overflow