Vulnerability Details CVE-2021-46416
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.063
EPSS Ranking 90.5%
CVSS Severity
CVSS v3 Score 8.1
CVSS v2 Score 5.5
References
- http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
- https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing
- https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
- http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
- https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing
- https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
Products affected by CVE-2021-46416
-
cpe:2.3:h:sma:sunny_tripower:5.0
-
cpe:2.3:o:sma:sunny_tripower_firmware:3.10.16.r