| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| SB3.0-1AV-41 | Sunny Boy 3.0 | < 3.10.27.R |
| SB3.6-1AV-41 | Sunny Boy 3.6 | < 3.10.27.R |
| SB4.0-1AV-41 | Sunny Boy 4.0 | < 3.10.27.R |
| SB5.0-1AV-41 | Sunny Boy 5.0 | < 3.10.27.R |
| SB6.0-1AV-41 | Sunny Boy 6.0 | < 3.10.27.R |
A security researcher discovered a Directory Traversal vulnerability in Sunny Boy 3, which allows remote attackers to access sensitive information. The vulnerability is already fixed since January 2021 with version 3.10.27.R.
An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.
Ahmed Alroky from KOIN Network
An authenticated user can access files and directories outside the intended web root.
Remediation
Update Firmware to at least version 3.10.27.R.
Ahmed Alroky from KOIN Network
CERT@VDE coordinated with SMA