CVE-2019-19228
📋 TL;DR
This vulnerability allows attackers to bypass authentication on Fronius Solar Inverter devices by reading the password for the 'today' account from the /tmp/web_users.conf file. This affects Fronius Solar Inverter devices with firmware versions before 3.14.1 (HM 1.12.1). Attackers can gain unauthorized access to device management interfaces.
💻 Affected Systems
- Fronius Solar Inverter Series
📦 What is this software?
Symo Advanced 10.0 3 208 240 Firmware by Fronius
View all CVEs affecting Symo Advanced 10.0 3 208 240 Firmware →
Symo Advanced 12.0 3 208 240 Firmware by Fronius
View all CVEs affecting Symo Advanced 12.0 3 208 240 Firmware →
Symo Advanced 15.0 3 480 Firmware by Fronius
Symo Advanced 20.0 3 480 Firmware by Fronius
Symo Advanced 22.7 3 480 Firmware by Fronius
Symo Advanced 24.0 3 480 Firmware by Fronius
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of solar inverter systems allowing attackers to manipulate power generation, cause equipment damage, or use devices as network pivots.
Likely Case
Unauthorized access to device management interfaces leading to configuration changes, data theft, or disruption of monitoring.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to management interfaces.
🎯 Exploit Status
Exploitation requires only reading a file accessible to the web service. Public exploit details are available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 3.14.1 (HM 1.12.1) or later
Restart Required: Yes
Instructions:
1. Download latest firmware from Fronius website. 2. Upload firmware to device via web interface. 3. Apply update. 4. Reboot device. 5. Verify firmware version is 3.14.1 or later.
🔧 Temporary Workarounds
Network Segmentation
allIsolate solar inverter management interfaces from untrusted networks
Access Control Lists
allRestrict access to inverter management ports (typically 80/443) to authorized IP addresses only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate inverter management interfaces from untrusted networks
- Deploy network-based intrusion detection to monitor for authentication bypass attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface. If version is below 3.14.1 (HM 1.12.1), device is vulnerable.Check Version:
Check web interface status page or use: curl -s http://[inverter-ip]/status | grep firmwareVerify Fix Applied:
Verify firmware version is 3.14.1 or later. Test authentication to confirm password is no longer stored in /tmp/web_users.conf.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful login from same IP
- Access to /tmp/web_users.conf file
Network Indicators:
- Unauthorized access to management ports (80/443) from unexpected sources
- Multiple authentication attempts with 'today' account
SIEM Query:
source="inverter_logs" AND (event="auth_failure" OR event="file_access" AND file="/tmp/web_users.conf")🔗 References
- http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/
- https://seclists.org/bugtraq/2019/Dec/5
- http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/
- https://seclists.org/bugtraq/2019/Dec/5
