Back to overview

SMA: Cluster Controller CSRF vulnerability

VDE-2024-020
Last update
02/12/2025 17:48
Published at
01/27/2025 14:00
Vendor(s)
SMA Solar Technology AG
External ID
VDE-2024-020
CSAF Document
Download

Summary

A security researcher discovered a Cross Site Request Forgery (CSRF, XSRF) vulnerability in SMA Cluster Controller. The affected products are out of support (End-of-Life 2018-06-30).

Impact

The vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with the user's permissions on the affected device.

Affected Product(s)

Model no. Product name Affected versions
SMA Cluster Controller Firmware vers:all/*

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:57
Severity
8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting firmware version 01.05.01.R and earlier. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected device.

References
cve.org | nvd.nist.gov

Mitigation

If you can not replace your Cluster Controller by a suitable up-to-date product then isolate the affected network segment by blocking all incoming network traffic. Especially never configure your network to allow a port forwarding to SMA Cluster Controller. Avoid accessing Internet resources while logged in to the Cluster Controller.

Remediation

Replace out-of-support Cluster Controller by a suitable up-to-date product. Please note technical information on the switchover to be found at www.sma-sunny.com/en/how-to-replace-o...

Revision History

Version Date Summary
1 01/20/2025 12:00 Initial revision.
2 02/12/2025 17:48 Fix: corrected self-reference