CVE-2024-50685
Published: 26 February 2025
Summary
CVE-2024-50685 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Sungrowpower Isolarcloud. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to information and resources, directly preventing IDOR by requiring proper checks on powerStationService API object references.
Validates information inputs such as object references in API requests to ensure they are legitimate and authorized, mitigating unauthorized access and manipulation in the powerStationService API.
Requires timely identification, reporting, and correction of flaws like this IDOR vulnerability, directly addressed by Sungrow's October 31, 2024 remediation update.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
IDOR in public-facing powerStationService API directly enables unauthenticated remote exploitation for unauthorized data access/modification.
NVD Description
SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService API model.
Deeper analysisAI
CVE-2024-50685 is an insecure direct object reference (IDOR) vulnerability, mapped to CWE-639, affecting SunGrow iSolarCloud platforms prior to the remediation released on October 31, 2024. The flaw exists in the powerStationService API model, allowing attackers to access or manipulate objects without proper authorization checks.
The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is exploitable over the network with low complexity by unauthenticated attackers requiring no user interaction. Successful exploitation enables high-impact confidentiality and integrity violations, such as unauthorized access to or modification of sensitive power station data and configurations.
Sungrow has addressed the issue with a remediation update released on October 31, 2024, as detailed in their security notice at https://en.sungrowpower.com/security-notice-detail-2/6118. Security practitioners should ensure iSolarCloud instances are updated to the patched version and review API access controls to mitigate IDOR risks.
Details
- CWE(s)