PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-0731 SMA CVE debrief

CVE-2025-0731 describes an SMB Sunny Portal issue in which an unauthenticated remote attacker could upload a .aspx file instead of a PV system picture through the demo account. The advisory says any resulting code execution is limited to the security context of the user, and CISA’s remediation notes state the vulnerability was closed in the portal on 2024-12-19, before the advisory publication date.

Vendor
SMA
Product
Sunny Portal
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-20
Original CVE updated
2025-03-20
Advisory published
2025-03-20
Advisory updated
2025-03-20

Who should care

Organizations operating or integrating SMA Sunny Portal, especially teams responsible for portal administration, account management, and web application review. Any environment that exposes the demo account path or relies on portal-hosted content should verify the vendor’s closure statement and confirm no residual exposure remains.

Technical summary

The reported weakness is an unauthenticated remote file-upload problem in SMA Sunny Portal. Instead of accepting only a PV system picture, the demo-account upload path could be abused to place an .aspx file. The vendor/CISA description indicates that any executed code would run only within the security context of the user, which limits impact but still creates integrity and availability risk. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) aligns with modest integrity and availability impact and no confidentiality impact.

Defensive priority

Medium, with verification urgency reduced by the vendor’s statement that the issue was closed in the portal on 2024-12-19. If you use Sunny Portal, confirm the closure applies to your deployment and that no affected exposure remains.

Recommended defensive actions

  • Review the CISA advisory and the SMA/CERT@VDE references for the affected Sunny Portal product scope.
  • Confirm your environment is not relying on any pre-2024-12-19 portal behavior or residual demo-account upload path exposure.
  • If you operate the portal or an integrated service, validate that only intended file types are accepted and that upload handling matches the vendor’s fixed behavior.
  • If you need product-specific confirmation, contact the SMA service center as recommended in the advisory.
  • Use CISA ICS recommended practices to reduce risk from web-facing industrial-support services and review account exposure, authentication paths, and upload controls.

Evidence notes

All statements are taken from the supplied CISA CSAF advisory and its reference list. The source describes the issue as an unauthenticated remote attacker uploading a .aspx file through the demo account, and states that the code can only execute in the security context of the user. The remediation section states: “No further action is required. The vulnerability was closed in the portal on December 19, 2024.” The advisory publication date provided in the corpus is 2025-03-20T06:00:00Z.

Official resources

CISA published the advisory on 2025-03-20. The supplied remediation note says the vulnerability was closed in the portal on 2024-12-19, so the fix date predates public disclosure.