PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50688 Sungrow CVE debrief

CISA’s 2025-03-13 advisory for CVE-2024-50688 says Sungrow’s iSolarCloud Android App (<= 2.1.6) and WiNet Firmware use hard-coded MQTT credentials when exchanging device telemetry. That creates a risk of unauthorized access to user accounts and sensitive information; the advisory also states an attacker may be able to execute arbitrary code. Sungrow’s stated remediation is to update WiNet firmware to WINET-SV200.001.00.P028 or higher and install the latest iSolarCloud app from the device app store.

Vendor
Sungrow
Product
iSolarCloud Android App
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-13
Original CVE updated
2025-03-13
Advisory published
2025-03-13
Advisory updated
2025-03-13

Who should care

Sungrow customers, installers, and operators using iSolarCloud-connected solar/energy systems; IT/OT security teams responsible for remote monitoring, mobile apps, or device telemetry paths; defenders managing fleets that include Sungrow WiNet firmware or the iSolarCloud Android app.

Technical summary

The advisory identifies hard-coded MQTT credentials in the iSolarCloud Android application and the cloud telemetry exchange path. The affected products listed by CISA are Sungrow iSolarCloud Android App <= 2.1.6 and Sungrow WiNet Firmware (all versions). Because the credentials are embedded rather than unique per deployment, an attacker who obtains them could potentially access telemetry-related resources and associated data. The supplied advisory text also notes possible arbitrary code execution, though the provided CVSS vector reflects a network-exploitable confidentiality issue.

Defensive priority

Medium. Prioritize if Sungrow telemetry, remote monitoring, or mobile app access is exposed in production environments, especially where OT visibility or operational data is shared across sites.

Recommended defensive actions

  • Update Sungrow WiNet firmware to WINET-SV200.001.00.P028 or higher.
  • Update the iSolarCloud Android app to the latest version from the device app store.
  • Inventory Sungrow deployments and confirm whether any systems run iSolarCloud Android App <= 2.1.6 or WiNet Firmware on affected versions.
  • Review telemetry and MQTT access controls for unexpected or unauthorized use.
  • Follow Sungrow’s security notice and CISA ICS recommended practices for segmentation, access control, and defense in depth.

Evidence notes

All substantive claims are taken from the supplied CISA CSAF advisory text and its remediation entries. The advisory states that the iSolarCloud Android application and the cloud use hard-coded MQTT credentials for exchanging device telemetry, affecting iSolarCloud Android App <= 2.1.6 and WiNet Firmware (all versions). The remediation section specifies WINET-SV200.001.00.P028 or higher for WiNet firmware and updating the iSolarCloud app via the app store. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50688 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50688

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50688 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50688

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-072-12.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-12

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.