CVE-2017-9860

An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to authenticate. If an attacker is able to create a custom firmware version that is accepted by the inverter, the inverter is compromised completely. This allows the attacker to do nearly anything: for example, giving access to the local OS, creating a botnet, using the inverters as a stepping stone into companies, etc. NOTE: the vendor reports that this attack has always been blocked by "a final integrity and compatibility check." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected

• CWE-287

• http://www.sma.de/en/statement-on-cyber-security.html
• http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf
• https://horusscenario.com/CVE-information/Third Party Advisory
• http://www.sma.de/en/statement-on-cyber-security.html
• http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf
• https://horusscenario.com/CVE-information/Third Party Advisory

Published

Aug 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9854An issue was discovered in SMA Solar Technology products. By…
• CVE-2017-9855An issue was discovered in SMA Solar Technology products. A …9.8
• CVE-2017-9856An issue was discovered in SMA Solar Technology products. Sn…3.4
• CVE-2017-9857An issue was discovered in SMA Solar Technology products. Th…
• CVE-2017-9858An issue was discovered in SMA Solar Technology products. By…
• CVE-2017-9859An issue was discovered in SMA Solar Technology products. Th…
• CVE-2017-9861An issue was discovered in SMA Solar Technology products. Th…
• CVE-2017-9862An issue was discovered in SMA Solar Technology products. Wh…
• CVE-2017-9863An issue was discovered in SMA Solar Technology products. If…
• CVE-2017-9864An issue was discovered in SMA Solar Technology products. An…
• CVE-2017-9865The function GfxImageColorMap::getGray in GfxState.cc in Pop…
• CVE-2017-9868In Mosquitto through 1.4.12, mosquitto.db (aka the persisten…