Vulnerability · Published Apr 7, 2022 · Assigned by mitre

CVE-2021-46416

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)4.3%top 8.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing x_refsource_MISC
https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html x_refsource_MISC
http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html x_refsource_MISC