漏洞标题
N/A
漏洞描述信息
**争议** 在SMA Solar Technology产品中发现一个问题。SIP实现未正确使用加密验证：它容易受到重放攻击、数据包注入攻击和中间人攻击。攻击者可以在 LAN 的任何位置成功使用 SIP 与设备通信。攻击者可以利用此来崩溃设备，阻止它与 SMA 服务器通信，利用已知 SIP 漏洞或从 SIP 通信中提取敏感信息。此外，由于 SIP 通信通道未加密，具有理解协议攻击者可以窃听通信。例如，可以从 SIP 通信中提取密码。请注意： vendor 的立场是，在隔离子网中不需要使用加密验证。此外，只有 Sunny Boy TLST-21 和 TL-21 和 Sunny Tripower TL-10 和 TL-30 可能受到影响。
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the device from anywhere within the LAN. An attacker may use this to crash the device, stop it from communicating with the SMA servers, exploit known SIP vulnerabilities, or find sensitive information from the SIP communications. Furthermore, because the SIP communication channel is unencrypted, an attacker capable of understanding the protocol can eavesdrop on communications. For example, passwords can be extracted. NOTE: the vendor's position is that authentication with encryption is not required on an isolated subnetwork. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
SMA Solar Technology inverter 安全漏洞
漏洞描述信息
SMA Solar Technology inverter是德国SMA公司的一款光伏逆变器设备。 SMA Solar Technology inverter中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务（崩溃或无法与其他SMA服务器通信）或获取敏感信息。
CVSS信息
N/A
漏洞类别
授权问题