CVE-2024-50697

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50697
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://en.sungrowpower.com/security-notice-detail-2/5961 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sungrowpower:winet-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:sungrowpower:winet-s:-:*:*:*:*:*:*:*
History

29 May 2025, 16:02

Type Values Removed Values Added
CPE cpe:2.3:o:sungrowpower:winet-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:sungrowpower:winet-s:-:*:*:*:*:*:*:*
References () https://en.sungrowpower.com/security-notice-detail-2/5961 - () https://en.sungrowpower.com/security-notice-detail-2/5961 - Vendor Advisory
First Time Sungrowpower
Sungrowpower winet-s
Sungrowpower winet-s Firmware

27 Jan 2025, 16:15

Type Values Removed Values Added
Summary
  • (es) En SunGrow WiNet-SV200.001.00.P027 y versiones anteriores, al descifrar mensajes MQTT, el código que analiza campos TLV específicos no tiene suficientes comprobaciones de los límites. Esto puede provocar un desbordamiento del búfer basado en la pila.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-120

24 Jan 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-24 23:15

Updated : 2025-05-29 16:02

NVD link : CVE-2024-50697

Mitre link : CVE-2024-50697

CVE.ORG link : CVE-2024-50697

JSON object : View

Products Affected

sungrowpower

  • winet-s
  • winet-s_firmware
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')