Cyber Posture

CVE-2024-50688

Critical

Published: 26 February 2025

Published
26 February 2025
Modified
07 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-50688 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Sungrowpower Isolarcloud. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

IA-5 mandates secure management, distribution, and protection of authenticators, directly preventing the use of hardcoded credentials in the application and cloud MQTT communications.

preventrespond

SI-2 requires identification, reporting, and timely remediation of software flaws like hardcoded credentials, enabling patching as recommended by the vendor.

prevent

SC-8 enforces confidentiality and integrity protections for network transmissions, mitigating interception and manipulation of MQTT device telemetry even with compromised credentials.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Why these techniques?

Hardcoded shared MQTT credentials directly enable unauthenticated remote access and manipulation of the public-facing telemetry service (T1190) via embedded application credentials (T1552.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for exchanging the device telemetry.

Deeper analysisAI

CVE-2024-50688 is a critical vulnerability in the SunGrow iSolarCloud Android application, affecting version V2.1.6.20241017 and prior releases. It stems from hardcoded credentials (CWE-798), where the application—regardless of the user account—and the associated cloud service share the same MQTT credentials for exchanging device telemetry data. This flaw earned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severe potential impact.

Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. By leveraging the static MQTT credentials, adversaries can intercept, manipulate, or spoof device telemetry communications between the app, cloud, and solar devices, potentially achieving high levels of confidentiality compromise (e.g., data exfiltration), integrity violations (e.g., falsified telemetry), and availability disruption (e.g., denial of telemetry exchange).

Sungrow has published a security notice at https://en.sungrowpower.com/security-notice-detail-2/6122 detailing the issue. Security practitioners should consult this advisory for vendor-recommended mitigations, such as updating to a patched application version.

Details

CWE(s)

Affected Products

sungrowpower
isolarcloud
≤ 2.1.6.20241104

CVEs Like This One

CVE-2024-50685Same product: Sungrowpower Isolarcloud
CVE-2024-50693Same product: Sungrowpower Isolarcloud
CVE-2024-50686Same product: Sungrowpower Isolarcloud
CVE-2024-50687Same product: Sungrowpower Isolarcloud
CVE-2024-50689Same product: Sungrowpower Isolarcloud
CVE-2024-50691Same product: Sungrowpower Isolarcloud
CVE-2024-50694Same vendor: Sungrowpower
CVE-2024-50698Same vendor: Sungrowpower
CVE-2024-50695Same vendor: Sungrowpower
CVE-2024-50697Same vendor: Sungrowpower

References