CVE-2025-7770

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.

• CWE-337

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02

Published

Aug 6, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7764A vulnerability classified as critical has been found in cod…9.8
• CVE-2025-7765A vulnerability classified as critical was found in code-pro…9.8
• CVE-2025-7766Lantronix Provisioning Manager is vulnerable to XML external…8.6
• CVE-2025-7767A vulnerability, which was classified as problematic, has be…5.4
• CVE-2025-7768Tigo Energy's Cloud Connect Advanced (CCA) device contains h…9.3
• CVE-2025-7769Tigo Energy's CCA is vulnerable to a command injection vulne…8.7
• CVE-2025-7771ThrottleStop.sys, a legitimate driver, exposes two IOCTL int…8.7
• CVE-2025-7772The Malcure Malware Scanner — #1 Toolset for WordPress Malwa…6.5
• CVE-2025-7773A security issue exists within the 5032 16pt Digital Configu…8.8
• CVE-2025-7774A security issue exists within the 5032 16pt Digital Configu…8.8
• CVE-2025-7775Memory overflow vulnerability leading to Remote Code Executi…9.8
• CVE-2025-7776Memory overflow vulnerability leading to unpredictable or er…9.8