ByteOS Network

Vulnerability Details :

CVE-2017-9853

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-05 Aug, 2017 | 17:00

Updated At-05 Aug, 2024 | 17:18

An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of characters. NOTE: the vendor reports that the 12-character limit provides "a very high security standard." Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:05 Aug, 2017 | 17:00

Updated At:05 Aug, 2024 | 17:18

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.sma.de/en/statement-on-cyber-security.html	x_refsource_MISC
https://horusscenario.com/CVE-information/	x_refsource_MISC
http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf	x_refsource_MISC

Hyperlink: http://www.sma.de/en/statement-on-cyber-security.html

Resource:

x_refsource_MISC

Hyperlink: https://horusscenario.com/CVE-information/

Resource:

x_refsource_MISC

Hyperlink: http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.sma.de/en/statement-on-cyber-security.html	x_refsource_MISC x_transferred
https://horusscenario.com/CVE-information/	x_refsource_MISC x_transferred
http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf	x_refsource_MISC x_transferred

Hyperlink: http://www.sma.de/en/statement-on-cyber-security.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://horusscenario.com/CVE-information/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:05 Aug, 2017 | 17:29

Updated At:20 Apr, 2025 | 01:37

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

sma>>sunny_boy_3600_firmware>>-

cpe:2.3:o:sma:sunny_boy_3600_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_3600>>-

cpe:2.3:h:sma:sunny_boy_3600:-:*:*:*:*:*:*:*

sma>>sunny_boy_5000_firmware>>-

cpe:2.3:o:sma:sunny_boy_5000_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_5000>>-

cpe:2.3:h:sma:sunny_boy_5000:-:*:*:*:*:*:*:*

sma>>sunny_tripower_core1_firmware>>-

cpe:2.3:o:sma:sunny_tripower_core1_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_core1>>-

cpe:2.3:h:sma:sunny_tripower_core1:-:*:*:*:*:*:*:*

sma>>sunny_tripower_15000tl_firmware>>-

cpe:2.3:o:sma:sunny_tripower_15000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_15000tl>>-

cpe:2.3:h:sma:sunny_tripower_15000tl:-:*:*:*:*:*:*:*

sma>>sunny_tripower_20000tl_firmware>>-

cpe:2.3:o:sma:sunny_tripower_20000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_20000tl>>-

cpe:2.3:h:sma:sunny_tripower_20000tl:-:*:*:*:*:*:*:*

sma>>sunny_tripower_25000tl_firmware>>-

cpe:2.3:o:sma:sunny_tripower_25000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_25000tl>>-

cpe:2.3:h:sma:sunny_tripower_25000tl:-:*:*:*:*:*:*:*

sma>>sunny_tripower_5000tl_firmware>>-

cpe:2.3:o:sma:sunny_tripower_5000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_5000tl>>-

cpe:2.3:h:sma:sunny_tripower_5000tl:-:*:*:*:*:*:*:*

sma>>sunny_tripower_12000tl_firmware>>-

cpe:2.3:o:sma:sunny_tripower_12000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_12000tl>>-

cpe:2.3:h:sma:sunny_tripower_12000tl:-:*:*:*:*:*:*:*

sma>>sunny_tripower_60_firmware>>-

cpe:2.3:o:sma:sunny_tripower_60_firmware:-:*:*:*:*:*:*:*

sma>>sunny_tripower_60>>-

cpe:2.3:h:sma:sunny_tripower_60:-:*:*:*:*:*:*:*

sma>>sunny_boy_3000tl_firmware>>-

cpe:2.3:o:sma:sunny_boy_3000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_3000tl>>-

cpe:2.3:h:sma:sunny_boy_3000tl:-:*:*:*:*:*:*:*

sma>>sunny_boy_3600tl_firmware>>-

cpe:2.3:o:sma:sunny_boy_3600tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_3600tl>>-

cpe:2.3:h:sma:sunny_boy_3600tl:-:*:*:*:*:*:*:*

sma>>sunny_boy_4000tl_firmware>>-

cpe:2.3:o:sma:sunny_boy_4000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_4000tl>>-

cpe:2.3:h:sma:sunny_boy_4000tl:-:*:*:*:*:*:*:*

sma>>sunny_boy_5000tl_firmware>>-

cpe:2.3:o:sma:sunny_boy_5000tl_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_5000tl>>-

cpe:2.3:h:sma:sunny_boy_5000tl:-:*:*:*:*:*:*:*

sma>>sunny_boy_1.5_firmware>>-

cpe:2.3:o:sma:sunny_boy_1.5_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_1.5>>-

cpe:2.3:h:sma:sunny_boy_1.5:-:*:*:*:*:*:*:*

sma>>sunny_boy_2.5_firmware>>-

cpe:2.3:o:sma:sunny_boy_2.5_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_2.5>>-

cpe:2.3:h:sma:sunny_boy_2.5:-:*:*:*:*:*:*:*

sma>>sunny_boy_3.0_firmware>>-

cpe:2.3:o:sma:sunny_boy_3.0_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_3.0>>-

cpe:2.3:h:sma:sunny_boy_3.0:-:*:*:*:*:*:*:*

sma>>sunny_boy_3.6_firmware>>-

cpe:2.3:o:sma:sunny_boy_3.6_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_3.6>>-

cpe:2.3:h:sma:sunny_boy_3.6:-:*:*:*:*:*:*:*

sma>>sunny_boy_4.0_firmware>>-

cpe:2.3:o:sma:sunny_boy_4.0_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_4.0>>-

cpe:2.3:h:sma:sunny_boy_4.0:-:*:*:*:*:*:*:*

sma>>sunny_boy_5.0_firmware>>-

cpe:2.3:o:sma:sunny_boy_5.0_firmware:-:*:*:*:*:*:*:*

sma>>sunny_boy_5.0>>-

cpe:2.3:h:sma:sunny_boy_5.0:-:*:*:*:*:*:*:*

sma>>sunny_central_2200_firmware>>-

cpe:2.3:o:sma:sunny_central_2200_firmware:-:*:*:*:*:*:*:*

sma>>sunny_central_2200>>-

cpe:2.3:h:sma:sunny_central_2200:-:*:*:*:*:*:*:*

sma>>sunny_central_1000cp_xt_firmware>>-

cpe:2.3:o:sma:sunny_central_1000cp_xt_firmware:-:*:*:*:*:*:*:*

sma>>sunny_central_1000cp_xt>>-

cpe:2.3:h:sma:sunny_central_1000cp_xt:-:*:*:*:*:*:*:*

sma>>sunny_central_800cp_xt_firmware>>-

cpe:2.3:o:sma:sunny_central_800cp_xt_firmware:-:*:*:*:*:*:*:*

sma>>sunny_central_800cp_xt>>-

cpe:2.3:h:sma:sunny_central_800cp_xt:-:*:*:*:*:*:*:*

sma>>sunny_central_850cp_xt_firmware>>-

cpe:2.3:o:sma:sunny_central_850cp_xt_firmware:-:*:*:*:*:*:*:*

sma>>sunny_central_850cp_xt>>-

cpe:2.3:h:sma:sunny_central_850cp_xt:-:*:*:*:*:*:*:*

sma>>sunny_central_900cp_xt_firmware>>-

cpe:2.3:o:sma:sunny_central_900cp_xt_firmware:-:*:*:*:*:*:*:*

sma>>sunny_central_900cp_xt>>-

cpe:2.3:h:sma:sunny_central_900cp_xt:-:*:*:*:*:*:*:*

sma>>sunny_central_500cp_xt_firmware>>-

cpe:2.3:o:sma:sunny_central_500cp_xt_firmware:-:*:*:*:*:*:*:*

sma>>sunny_central_500cp_xt>>-

cpe:2.3:h:sma:sunny_central_500cp_xt:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-521	Primary	nvd@nist.gov

CWE ID: CWE-521

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.sma.de/en/statement-on-cyber-security.html	cve@mitre.org	N/A
http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf	cve@mitre.org	N/A
https://horusscenario.com/CVE-information/	cve@mitre.org	Third Party Advisory
http://www.sma.de/en/statement-on-cyber-security.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf	af854a3a-2127-422b-91ae-364da2661108	N/A
https://horusscenario.com/CVE-information/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

Hyperlink: http://www.sma.de/en/statement-on-cyber-security.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://horusscenario.com/CVE-information/

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: http://www.sma.de/en/statement-on-cyber-security.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://horusscenario.com/CVE-information/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Similar CVEs

55Records found

CVE-2017-1601

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.53% / 66.25%

7 Day CHG~0.00%

Published-02 May, 2018 | 13:00

Updated-05 Aug, 2024 | 13:39

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624.

Vendor-n/a IBM Corporation

Product-security_guardium_database_activity_monitor n/a

CWE ID-CWE-521

Weak Password Requirements

CVE-2022-3268

Matching Score-4

Assigner-Protect AI (formerly huntr.dev)

View Details

Matching Score-4

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-9.8||CRITICAL

EPSS-0.16% / 37.72%

7 Day CHG~0.00%

Published-22 Sep, 2022 | 09:20

Updated-23 May, 2025 | 20:30

Weak Password Requirements in ikus060/minarca

Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.

Vendor-IKUS Software

Product-minarca ikus060/minarca

CWE ID-CWE-521

Weak Password Requirements

CVE-2021-25309

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.56% / 67.14%

7 Day CHG~0.00%

Published-02 Mar, 2021 | 00:41

Updated-03 Aug, 2024 | 20:03

The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situation (together with the weak password policy that forces a 4-digit password) allows remote attackers to easily obtain administrative access via brute-force attacks.

Vendor-gigaset n/a

Product-dx600a dx600a_firmware n/a

CWE ID-CWE-521

Weak Password Requirements

CWE ID-CWE-307

Improper Restriction of Excessive Authentication Attempts

CVE-2021-25839

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.40% / 60.18%

7 Day CHG~0.00%

Published-26 Apr, 2021 | 13:30

Updated-03 Aug, 2024 | 20:11

A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing.

Vendor-minthcm n/a

Product-minthcm n/a

CWE ID-CWE-521

Weak Password Requirements

CVE-2021-20470

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.9||MEDIUM

EPSS-0.26% / 48.77%

7 Day CHG~0.00%

Published-03 Dec, 2021 | 17:00

Updated-17 Sep, 2024 | 03:17

IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-521

Weak Password Requirements

CVE-2017-9853

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs