CVE-2023-35837

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has a default password, equal to the registration ID of the device. This same registration ID is used as the WiFi SSID name. No routine is in place to force a change to this password on first use or bring its default state to the attention of the user. Once authenticated, an attacker can reconfigure the device or upload new firmware, both of which can lead to Denial of Service, code execution, or Escalation of Privileges.

• https://www.solaxpower.com/downloads/Not Applicable
• https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/Product
• https://yougottahackthat.com/blog/Third Party Advisory
• https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authenticationThird Party Advisory
• https://www.solaxpower.com/downloads/Not Applicable
• https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/Product
• https://yougottahackthat.com/blog/Third Party Advisory
• https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authenticationThird Party Advisory

Published

Jan 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35828An issue was discovered in the Linux kernel before 6.3.2. A …7
• CVE-2023-35829An issue was discovered in the Linux kernel before 6.3.2. A …7
• CVE-2023-35830STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module…9.8
• CVE-2023-35833An issue was discovered in YSoft SAFEQ 6 Server before 6.0.8…6.5
• CVE-2023-35835An issue was discovered in SolaX Pocket WiFi 3 through 3.001…9.8
• CVE-2023-35836An issue was discovered in SolaX Pocket WiFi 3 through 3.001…6.5
• CVE-2023-35838The WireGuard client 0.5.3 on Windows insecurely configures …5.7
• CVE-2023-35839A bypass in the component sofa-hessian of Solon before v2.3.…9.8
• CVE-2023-3584Mattermost fails to properly check the authorization of POST…3.1
• CVE-2023-35840_joinPath in elFinderVolumeLocalFileSystem.class.php in elFi…6.5
• CVE-2023-35841Exposed IOCTL with Insufficient Access Control in Phoenix Wi…7.8
• CVE-2023-35843NocoDB through 0.106.0 (or 0.109.1) has a path traversal vul…7.5