PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50684 Sungrow CVE debrief

CVE-2024-50684 is a medium-severity weakness in Sungrow’s iSolarCloud Android app and related WiNet firmware advisory. CISA states the Android app used an insecure AES key with insufficient entropy to encrypt client data, which could allow decryption of intercepted communications between the app and iSolarCloud. Sungrow’s remediation guidance says updated WiNet firmware is available and the iSolarCloud app has been repaired in the latest store release.

Vendor
Sungrow
Product
iSolarCloud Android App
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-13
Original CVE updated
2025-03-13
Advisory published
2025-03-13
Advisory updated
2025-03-13

Who should care

Organizations using Sungrow iSolarCloud Android App version 2.1.6 or earlier, and environments that deploy Sungrow WiNet firmware, should review this advisory. Security and operations teams supporting mobile-to-cloud workflows in industrial or energy management environments should confirm updates are applied.

Technical summary

The advisory describes weak cryptographic key generation in the iSolarCloud Android application: an insecure AES key with insufficient entropy. Because the key material is predictable or weak, an attacker able to intercept traffic may be able to decrypt communications between the mobile app and iSolarCloud. CISA’s CSAF lists affected products as Sungrow iSolarCloud Android App <=2.1.6 and Sungrow WiNet Firmware: all versions. The provided CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, scoring 6.5 (Medium).

Defensive priority

Medium

Recommended defensive actions

  • Update Sungrow WiNet firmware to WINET-SV200.001.00.P028 or higher, as directed in the advisory.
  • Update the iSolarCloud Android app to the latest version from the device app store.
  • Verify asset inventories for Sungrow iSolarCloud Android App version 2.1.6 or earlier and any deployed WiNet firmware.
  • Review mobile-to-cloud communications for expected TLS/transport protections and confirm no reliance on weak client-side encryption for sensitive data.
  • Monitor Sungrow’s security notice page and CISA advisory for any follow-up guidance or clarifications.

Evidence notes

This debrief is based on the CISA CSAF advisory published on 2025-03-13 and the linked official CVE record. The advisory text states that the iSolarCloud Android mobile application uses an insecure AES key with insufficient entropy, which may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud. The CSAF also lists affected products as Sungrow iSolarCloud Android App <=2.1.6 and Sungrow WiNet Firmware: vers:all/*. Remediation guidance in the advisory directs users to apply WINET-SV200.001.00.P028 or higher and update the iSolarCloud Android App to the latest version via the device app store.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50684 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50684

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50684 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50684

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-072-12.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-12

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.