SMA Solar Technology AG will not be fixing a cross-site request forgery in its Sunny WebBox because the product is beyond its end of life, according to report with CISA.
Successful exploitation of this remotely exploitable vulnerability could allow an attacker to generate a denial-of-service condition, modify passwords, enable services, achieve man-in-the-middle, and modify input parameters associated with devices such as sensors.
Borja Merino and Eduardo Villaverde of the Technical Inspection Laboratory of the Mining School (University of León), through Adenda 2, coordinated this vulnerability with Carlos del Canto and Victor Fidalgo of INCIBE-CERT’s Industrial Cybersecurity Team.
Firmware Version 1.6 and prior of Sunny WebBox suffers from the issue.
In the vulnerability, an attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
CVE-2019-13529 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.6.
The product sees use mainly in the energy sector. It does, however, see action on a global basis.
No known public exploits specifically target this vulnerability. However, an attacker with low skill level could leverage the vulnerability.
This product is end-of-life and is no longer supported.
SMA recommends deactivation of port forwarding as it is not required for monitoring PV systems via the SMA Sunny Portal. If direct access to a system from the Internet is necessary, SMA recommends using an encrypted virtual private network (VPN). On delivery, any saved default passwords should also be replaced with individual secure passwords, and unused ports on the system/router should be closed.
SMA installers and administrators can answer specific questions about individual configuration of SMA devices. Click here for basic information on this topic.