CVE-2017-9854

Q: What is the severity of CVE-2017-9854?

CVE-2017-9854 has a CVSS score of 9.8 (CRITICAL). This vulnerability in SMA Solar Technology products allows attackers to capture plaintext passwords by sniffing network packets on the localhost when users type passwords into Sunny Explorer. The passwords can then be used to compromise the overall device. Only specific SMA Solar inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30) are affected.

9.8 CRITICAL

📋 TL;DR

This vulnerability in SMA Solar Technology products allows attackers to capture plaintext passwords by sniffing network packets on the localhost when users type passwords into Sunny Explorer. The passwords can then be used to compromise the overall device. Only specific SMA Solar inverters (Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-10/TL-30) are affected.

💻 Affected Systems

Products:

SMA Sunny Boy TLST-21
SMA Sunny Boy TL-21
SMA Sunny Tripower TL-10
SMA Sunny Tripower TL-30

Versions: All versions prior to vendor security updates

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using Sunny Explorer software for configuration. Vulnerability requires local network access during password entry.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access to solar inverters, potentially disrupting power generation, manipulating energy data, or using devices as network footholds.

🟠

Likely Case

Limited impact since exploitation requires local network access during password entry, which typically occurs only during initial installation.

🟢

If Mitigated

Minimal impact with proper network segmentation and monitoring preventing unauthorized local network access.

🌐 Internet-Facing: LOW

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires network sniffing capabilities on the local network segment during password entry events.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor documentation for specific firmware versions

Vendor Advisory: http://www.sma.de/en/statement-on-cyber-security.html

Restart Required: Yes

Instructions:

1. Consult SMA Solar Technology security documentation. 2. Update affected inverter firmware to latest secure version. 3. Update Sunny Explorer software. 4. Restart affected devices.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate solar inverter management network from general corporate/IT networks

Encrypted Management

all

Use VPN or encrypted tunnels for all remote management connections

🧯 If You Can't Patch

Physically secure inverter installation locations to prevent unauthorized local network access
Implement strict network monitoring for unusual packet sniffing activity on management VLANs

🔍 How to Verify

Check if Vulnerable:

Check device model against affected products list and verify firmware version is not latest secure version

Check Version:

Check via Sunny Explorer interface or device web interface

Verify Fix Applied:

Confirm firmware has been updated to version referenced in SMA security advisory

📡 Detection & Monitoring

Log Indicators:

Multiple failed authentication attempts
Unusual network traffic patterns during non-installation periods

Network Indicators:

ARP spoofing or promiscuous mode detection on management network
Unusual packet capture activity on inverter management VLAN

SIEM Query:

source="network_sensors" AND (event_type="arp_spoofing" OR event_type="promiscuous_mode") AND dest_ip IN (inverter_management_ips)

📊 Metadata

CVE ID: CVE-2017-9854

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-311

Published: August 5, 2017

Last Updated: April 20, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Sunny Boy 1.5 Firmware by Sma

Sunny Boy 2.5 Firmware by Sma

Sunny Boy 3.0 Firmware by Sma

Sunny Boy 3.6 Firmware by Sma

Sunny Boy 3000tl Firmware by Sma

Sunny Boy 3600 Firmware by Sma

Sunny Boy 3600tl Firmware by Sma

Sunny Boy 4.0 Firmware by Sma

Sunny Boy 4000tl Firmware by Sma

Sunny Boy 5.0 Firmware by Sma

Sunny Boy 5000 Firmware by Sma

Sunny Boy 5000tl Firmware by Sma

Sunny Boy Storage 2.5 Firmware by Sma

Sunny Central 1000cp Xt Firmware by Sma

Sunny Central 2200 Firmware by Sma

Sunny Central 500cp Xt Firmware by Sma

Sunny Central 630cp Xt Firmware by Sma

Sunny Central 720cp Xt Firmware by Sma

Sunny Central 760cp Xt Firmware by Sma

Sunny Central 800cp Xt Firmware by Sma

Sunny Central 850cp Xt Firmware by Sma

Sunny Central 900cp Xt Firmware by Sma

Sunny Central Storage 1000 Firmware by Sma

Sunny Central Storage 2200 Firmware by Sma

Sunny Central Storage 2500 Ev Firmware by Sma

Sunny Central Storage 500 Firmware by Sma

Sunny Central Storage 630 Firmware by Sma

Sunny Central Storage 720 Firmware by Sma

Sunny Central Storage 760 Firmware by Sma

Sunny Central Storage 800 Firmware by Sma

Sunny Central Storage 850 Firmware by Sma

Sunny Central Storage 900 Firmware by Sma

Sunny Tripower 12000tl Firmware by Sma

Sunny Tripower 15000tl Firmware by Sma

Sunny Tripower 20000tl Firmware by Sma

Sunny Tripower 25000tl Firmware by Sma

Sunny Tripower 5000tl Firmware by Sma

Sunny Tripower 60 Firmware by Sma

Sunny Tripower Core1 Firmware by Sma