Vulnerability · Published Aug 6, 2025 · Assigned by icscert

CVE-2025-7768Use of Hard-coded Credentials in Tigo Energy Cloud Connect Advanced

Critical 9.3

In plain English

A critical-severity hard-coded credentials in Cloud Connect Advanced from Tigo Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.6%top 50.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms.

Affected products (as reported)

Vendor	Product	Versions
Tigo Energy	Cloud Connect Advanced	0 – through 4.0.1

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02 government-resource