| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| www.sunnyportal.com | < 19.12.2024 |
A security researcher discovered a critical Remote Code Execution vulnerability in sunnyportal.com. An attacker could upload code instead of an image and remotely execute this code.
Update: Changed Date in Remediation
An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.
An unauthenticated attacker could upload code instead of an image in the demo section of the portal and can remotely execute this code.
Remediation
No action required. The vulnerability was closed in the portal on December, 19, 2024.
CERT@VDE coordinated with SMA
Reported by Francesco La Spina from Forescout Technologies Inc.