CVE-2020-9306

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.

• CWE-522
• CWE-798

• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0019/FEYE-2020-0019.mdThird Party Advisory
• https://www.fireeye.com/blog/threat-research.htmlThird Party Advisory
• https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.htmlThird Party Advisory
• https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.htmlExploit, Third Party Advisory
• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0019/FEYE-2020-0019.mdThird Party Advisory
• https://www.fireeye.com/blog/threat-research.htmlThird Party Advisory
• https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.htmlThird Party Advisory
• https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.htmlExploit, Third Party Advisory

Published

Feb 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9296Netflix Titus uses Java Bean Validation (JSR 380) custom con…9.8
• CVE-2020-9297Netflix Titus, all versions prior to version v0.1.1-rc.274, …9.8
• CVE-2020-9298The Spinnaker template resolution functionality is vulnerabl…7.5
• CVE-2020-9299There were XSS vulnerabilities discovered and reported in th…5.4
• CVE-2020-9300The Access Control issues include allowing a regular user to…6.5
• CVE-2020-9301Nolan Ray from Apple Information Security identified a secur…8.8
• CVE-2020-9307Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 al…6.5
• CVE-2020-9308archive_read_support_format_rar5.c in libarchive before 3.4.…8.8
• CVE-2020-9309Silverstripe CMS through 4.5 can be susceptible to script ex…8.8
• CVE-2020-9310Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9311In SilverStripe through 4.5, malicious users with a valid Si…5.4
• CVE-2020-9314** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web…4.8