CVE-2024-50684
📋 TL;DR
The SunGrow iSolarCloud Android app uses a weak AES encryption key with insufficient randomness, allowing attackers to decrypt communications between the mobile app and cloud service. This affects all users of the Android app versions 2.1.6.20241017 and earlier who transmit sensitive data through the application.
💻 Affected Systems
- SunGrow iSolarCloud Android mobile application
📦 What is this software?
Isolarcloud by Sungrowpower
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept and decrypt all communications between the app and cloud service, exposing sensitive solar system data, user credentials, and potentially gaining control over connected solar equipment.
Likely Case
Attackers on the same network can decrypt transmitted data, potentially accessing solar system performance metrics, user information, and configuration details.
If Mitigated
With proper network segmentation and monitoring, impact is limited to data exposure without system compromise.
🎯 Exploit Status
Exploitation requires network access to intercept communications. No authentication needed to decrypt once traffic is captured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after V2.1.6.20241017
Vendor Advisory: https://en.sungrowpower.com/security-notice-detail-2/6126
Restart Required: Yes
Instructions:
1. Open Google Play Store on Android device. 2. Search for 'iSolarCloud'. 3. Update to latest version. 4. Restart the application after update.
🔧 Temporary Workarounds
Disable app usage on untrusted networks
allPrevent using the iSolarCloud app on public or untrusted Wi-Fi networks to reduce interception risk.
Use VPN for all app communications
allRoute all app traffic through a trusted VPN to encrypt communications at network layer.
🧯 If You Can't Patch
- Discontinue use of vulnerable app versions and switch to web interface if available
- Implement network monitoring for unusual traffic patterns from the app
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > iSolarCloud > App info. If version is 2.1.6.20241017 or earlier, you are vulnerable.Check Version:
adb shell dumpsys package com.sungrow.isolarcloud | grep versionNameVerify Fix Applied:
Update app via Google Play Store and verify version is newer than 2.1.6.20241017.📡 Detection & Monitoring
Log Indicators:
- Unusual decryption errors in app logs
- Multiple failed authentication attempts
Network Indicators:
- Unencrypted or weakly encrypted traffic to iSolarCloud servers
- Man-in-the-middle attack patterns
SIEM Query:
source="android_app" app_name="iSolarCloud" version="2.1.6.20241017" OR version<="2.1.6.20241017"