CVE-2024-50691

HIGH

SunGrow iSolarCloud < 2.1.6.20241115 - Missing SSL Certificate Validation

Title source: llm

Description

SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM attacks. Attackers can impersonate the iSolarCloud server and communicate with the Android app.

References (1)

Core 1

Core References

Vendor Advisory

https://en.sungrowpower.com/security-notice-detail-2/6124

Scores

CVSS v3 7.4

EPSS 0.0022

EPSS Percentile 12.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-295

Status published

Products (1)

sungrowpower/isolarcloud < 2.1.6.20241115

Published Feb 26, 2025

Tracked Since Feb 18, 2026