Log in Start free

Vulnerability · Published Nov 27, 2024 · Assigned by CERTVDE

CVE-2024-11025SMA: SQL injection in Sunny Central UP

Medium 5.4

In plain English

A medium-severity SQL injection in Sunny Central SC 1760-US from SMA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 84.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.

Affected products (as reported)

VendorProductVersions
SMA Sunny Central SC 1760-US 0 – before 10.01.18.R
SMA Sunny Central SC 1850-US 0 – before 10.01.18.R
SMA Sunny Central SC 2000 EV-US 0 – before 10.01.18.R
SMA Sunny Central SC 2000-US 0 – before 10.01.18.R
SMA Sunny Central SC-2200-10 0 – before 10.01.18.R
SMA Sunny Central SC 2200-US 0 – before 10.01.18.R
SMA Sunny Central SC-2475-10 0 – before 10.01.18.R
SMA Sunny Central SC 2500 EV-US 0 – before 10.01.18.R
SMA Sunny Central SC 2660 UP 0 – before 10.01.18.R
SMA Sunny Central SC 2660 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 2750 EV-US 0 – before 10.01.18.R
SMA Sunny Central SC 2750 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 2800 UP 0 – before 10.01.18.R
SMA Sunny Central SC 2800 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 2930 UP 0 – before 10.01.18.R
SMA Sunny Central SC 2930 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 3060 UP 0 – before 10.01.18.R
SMA Sunny Central SC 3060 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 4000 UP 0 – before 10.01.18.R
SMA Sunny Central SC 4000 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 4200 UP 0 – before 10.01.18.R
SMA Sunny Central SC 4200 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 4400 UP 0 – before 10.01.18.R
SMA Sunny Central SC 4400 UP-JP 0 – before 10.01.18.R
SMA Sunny Central SC 4400 UP-US 0 – before 10.01.18.R
SMA Sunny Central SC 4600 UP 0 – before 10.01.18.R
SMA Sunny Central SC 4600 UP-US 0 – before 10.01.18.R
SMA Sunny Central Storage SCS-1900-10 0 – before 10.01.18.R
SMA Sunny Central Storage SCS-2200-10 0 – before 10.01.18.R
SMA Sunny Central Storage SCS 2300 UP-XT 0 – before 10.01.18.R

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References