high8.1Public exploit code
CVE-2021-46416
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)2022-04-11 · webapps · hardware
Impact
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sma | Sunny Tripower Firmware | Version 3.10.16.r |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
- https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing
- https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
- http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
- https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing
- https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
- http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html