Summary
A security researcher discovered a privilege escalation vulnerability in the demo system area of the SMA Classic Portal, www.sunnyportal.com.
Only systems of other users have been affected who unintendedly and illicitly had added their non-demo systems to the demo system area.
Impact
An unauthenticated attacker could get access to systems within the demo-system area. Limited to the demo-systems provided there the attacker could change parameters and configuration data. No indicators of compromise have been identified.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| www.sunnyportal.com <20.02.2025 | www.sunnyportal.com <20.02.2025 |
Vulnerabilities
Expand / Collapse allAn unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
Remediation
No action required. The vulnerability was closed in the portal backend on Feb 20th, 2025. A workaround mitigating the impact was implemented on Jan 20th, 2025 immediately after reporting of the issue.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 05/13/2025 13:00 | Initial revision. |
| 2 | 05/14/2025 15:00 | Fix: added distribution |