The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.
References
| Link | Resource |
|---|---|
| https://r.sec-consult.com/solax |
Configurations
No configuration.
History
12 Feb 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.4 |
12 Feb 2026, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-12 11:15
Updated : 2026-02-12 15:16
NVD link : CVE-2025-15573
Mitre link : CVE-2025-15573
CVE.ORG link : CVE-2025-15573
JSON object : View
Products Affected
No product.
CWE
CWE-295
Improper Certificate Validation