CVE-2017-9864
An issue was discovered in SMA Solar Technology products.
Published 9 y ago · modified 4 mo ago · JSON
Summary
An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system time, possibly affecting lockout policies and random-number generators based on timestamps, and makes timestamps for data analysis unreliable. NOTE: the vendor reports that this is largely irrelevant because it only affects log-entry timestamps, and because the plant time would later be reset via NTP. (It has never been the case that a lockout policy or random-number generator was affected.) Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected
Exploit prediction (EPSS)
1.51% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
- sma.de /en/statement-on-cyber-security.html · x_refsource_MISC, x_transferred
- horusscenario.com /CVE-information/ · x_refsource_MISC, x_transferred
- sma.de /fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-9864
- NVD: CVE-2017-9864
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.