CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT communications are vulnerable to MitM attacks at the TCP/IP level.

• CWE-798

• https://en.sungrowpower.com/security-notice-detail-2/5961Vendor Advisory
• https://mqtt-pwn.readthedocs.io/en/latest/intro.htmlProduct

Published

Jan 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50687SunGrow iSolarCloud before the October 31, 2024 remediation …9.1
• CVE-2024-50688SunGrow iSolarCloud Android application V2.1.6.20241017 and …9.8
• CVE-2024-50689SunGrow iSolarCloud before the October 31, 2024 remediation …9.1
• CVE-2024-5069A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-50690SunGrow WiNet-SV200.001.00.P027 and earlier versions contain…6.5
• CVE-2024-50691SunGrow iSolarCloud Android app V2.1.6.20241104 and prior su…7.4
• CVE-2024-50693SunGrow iSolarCloud before the October 31, 2024 remediation …9.1
• CVE-2024-50694In SunGrow WiNet-SV200.001.00.P027 and earlier versions, whe…9.8
• CVE-2024-50695SunGrow WiNet-SV200.001.00.P027 and earlier versions is vuln…9.8
• CVE-2024-50696SunGrow WiNet-S V200.001.00.P025 and earlier versions is mis…7.5
• CVE-2024-50697In SunGrow WiNet-SV200.001.00.P027 and earlier versions, whe…8.1
• CVE-2024-50698SunGrow WiNet-SV200.001.00.P027 and earlier versions is vuln…9.8