CVE-2024-50687
Published: 26 February 2025
Summary
CVE-2024-50687 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Sungrowpower Isolarcloud. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to information and system resources, directly preventing unauthorized object access via IDOR in the devService API.
Authorizes access to specific system resources by defined personnel or roles, ensuring direct object references are validated against user permissions to mitigate IDOR exploitation.
Employs least privilege to restrict access scope, limiting the confidentiality and integrity impacts of successful IDOR attacks on sensitive data.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
IDOR in public-facing cloud API directly enables remote exploitation of the application (T1190) and unauthorized access to cloud-hosted data repositories (T1530).
NVD Description
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model.
Deeper analysisAI
CVE-2024-50687 is an insecure direct object reference (IDOR) vulnerability, classified under CWE-639, affecting SunGrow iSolarCloud platforms prior to the remediation released on October 31, 2024. The flaw exists in the devService API model, allowing unauthorized access to objects through direct references without proper access controls.
The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation enables high-impact confidentiality and integrity violations, such as reading or modifying sensitive data belonging to other users or entities via manipulated API requests.
SunGrow published a security notice detailing the issue at https://en.sungrowpower.com/security-notice-detail-2/6114, confirming the remediation deployed on October 31, 2024, as the primary mitigation for affected iSolarCloud instances.
Details
- CWE(s)