CVE-2025-15574

{"id": "CVE-2025-15574", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2026-02-12T11:15:49.117", "references": [{"url": "https://r.sec-consult.com/solax", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the \"registration number\" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters."}, {"lang": "es", "value": "Al conectarse al servidor MQTT de Solax Cloud, el nombre de usuario es el 'n\u00famero de registro', que es la cadena de 10 caracteres impresa en el dispositivo SolaX Power Pocket / el c\u00f3digo QR del dispositivo. La contrase\u00f1a se deriva del 'n\u00famero de registro' utilizando un algoritmo propietario de XOR/transposici\u00f3n. Atacantes con conocimiento de los n\u00fameros de registro pueden conectarse al servidor MQTT e suplantar el dongle / los inversores."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}