CVE-2017-9859

Q: What is the severity of CVE-2017-9859?

CVE-2017-9859 has a CVSS score of 9.8 (CRITICAL). SMA Solar Technology inverters use a weak hashing algorithm to encrypt passwords for REGISTER requests, allowing attackers to crack passwords offline and potentially register with SMA servers. This affects Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 inverters. The vendor considers exploitation probability extremely low.

9.8 CRITICAL

📋 TL;DR

SMA Solar Technology inverters use a weak hashing algorithm to encrypt passwords for REGISTER requests, allowing attackers to crack passwords offline and potentially register with SMA servers. This affects Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 inverters. The vendor considers exploitation probability extremely low.

💻 Affected Systems

Products:

Sunny Boy TLST-21
Sunny Boy TL-21
Sunny Tripower TL-10
Sunny Tripower TL-30

Versions: All versions prior to vendor security updates

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Only specific SMA Solar Technology inverter models are affected according to vendor statement.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain unauthorized access to SMA servers, potentially manipulating inverter operations or accessing sensitive solar infrastructure data.

🟠

Likely Case

Limited impact due to vendor's position on low probability and specific affected models; potential unauthorized registration but limited operational impact.

🟢

If Mitigated

Minimal impact if proper network segmentation and monitoring are implemented, as exploitation requires specific conditions.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires offline password cracking and network access to registration requests.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor documentation for specific firmware updates

Vendor Advisory: http://www.sma.de/en/statement-on-cyber-security.html

Restart Required: Yes

Instructions:

1. Consult SMA Solar Technology security documentation. 2. Apply recommended firmware updates. 3. Restart affected inverters. 4. Verify updated firmware version.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate affected inverters from untrusted networks to prevent registration request interception.

Monitoring Registration Traffic

all

Monitor network traffic for REGISTER requests and investigate anomalies.

🧯 If You Can't Patch

Implement strict network segmentation to isolate inverters
Monitor for unusual registration attempts and network traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check inverter model and firmware version against vendor's affected products list.

Check Version:

Consult SMA inverter management interface or documentation for version check commands.

Verify Fix Applied:

Verify firmware version has been updated to vendor-recommended secure version.

📡 Detection & Monitoring

Log Indicators:

Unusual REGISTER request patterns
Failed registration attempts from unknown sources

Network Indicators:

Unexpected outbound traffic to SMA servers
Anomalous registration protocol traffic

SIEM Query:

source_ip IN (inverter_ips) AND dest_port = (registration_port) AND protocol = 'REGISTER'

📊 Metadata

CVE ID: CVE-2017-9859

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-327

Published: August 5, 2017

Last Updated: April 20, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Sunny Boy 1.5 Firmware by Sma

Sunny Boy 2.5 Firmware by Sma

Sunny Boy 3.0 Firmware by Sma

Sunny Boy 3.6 Firmware by Sma

Sunny Boy 3000tl Firmware by Sma

Sunny Boy 3600 Firmware by Sma

Sunny Boy 3600tl Firmware by Sma

Sunny Boy 4.0 Firmware by Sma

Sunny Boy 4000tl Firmware by Sma

Sunny Boy 5.0 Firmware by Sma

Sunny Boy 5000 Firmware by Sma

Sunny Boy 5000tl Firmware by Sma

Sunny Boy Storage 2.5 Firmware by Sma

Sunny Central 1000cp Xt Firmware by Sma

Sunny Central 2200 Firmware by Sma

Sunny Central 500cp Xt Firmware by Sma

Sunny Central 630cp Xt Firmware by Sma

Sunny Central 720cp Xt Firmware by Sma

Sunny Central 760cp Xt Firmware by Sma

Sunny Central 800cp Xt Firmware by Sma

Sunny Central 850cp Xt Firmware by Sma

Sunny Central 900cp Xt Firmware by Sma

Sunny Central Storage 1000 Firmware by Sma

Sunny Central Storage 2200 Firmware by Sma

Sunny Central Storage 2500 Ev Firmware by Sma

Sunny Central Storage 500 Firmware by Sma

Sunny Central Storage 630 Firmware by Sma

Sunny Central Storage 720 Firmware by Sma

Sunny Central Storage 760 Firmware by Sma

Sunny Central Storage 800 Firmware by Sma

Sunny Central Storage 850 Firmware by Sma

Sunny Central Storage 900 Firmware by Sma

Sunny Tripower 12000tl Firmware by Sma

Sunny Tripower 15000tl Firmware by Sma

Sunny Tripower 20000tl Firmware by Sma

Sunny Tripower 25000tl Firmware by Sma

Sunny Tripower 5000tl Firmware by Sma

Sunny Tripower 60 Firmware by Sma

Sunny Tripower Core1 Firmware by Sma