| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| www.sunnyportal.com | < 20.02.2025 |
A security researcher discovered a privilege escalation vulnerability in the demo system area of the SMA Classic Portal, www.sunnyportal.com. Only systems of other users have been affected who unintendedly and illicitly had added their non-demo systems to the demo system area.
An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
An unauthenticated attacker could get access to systems within the demo-system area. Limited to the demo-systems provided there the attacker could change parameters and configuration data. No indicators of compromise have been identified.
Remediation
No action required. The vulnerability was closed in the portal backend on Feb 20th, 2025. A workaround mitigating the impact was implemented on Jan 20th, 2025 immediately after reporting of the issue.
CERT@VDE coordinated with SMA
Reporting: Jannik Zimmer