{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]},{"organization":"Jannik Zimmer","summary":"reporting"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"audience":"csaf creator","category":"other","text":"[CERT@VDE CSAF Template](https://github.com/CERTVDE/CSAF-Template) © 2024 by [CERT@VDE](https://certvde.com) is licensed under [CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) \n\nThis document note may only be removed in order to create a CSAF advisory based on this template.","title":"LICENSE"},{"category":"summary","text":"A security researcher discovered a privilege escalation vulnerability in the demo system area of the SMA Classic Portal, www.sunnyportal.com.\nOnly systems of other users have been affected who unintendedly and illicitly had added their non-demo systems to the demo system area.","title":"Summary"},{"category":"description","text":"An unauthenticated attacker could get access to systems within the demo-system area. Limited to the demo-systems provided there the attacker could change parameters and configuration data.  No indicators of compromise have been identified.","title":"Impact"},{"category":"description","text":"No action required. The vulnerability was closed in the portal backend on Feb 20th, 2025. A workaround mitigating the impact was implemented on Jan 20th, 2025 immediately after reporting of the issue.","title":"Remediation"},{"category":"description","text":"Sunny Portal is an online portal for SMA customers to monitor their PV Systems","title":"Product Description"}],"publisher":{"category":"vendor","contact_details":"information-security@sma.de","name":"SMA Solar Technology AG","namespace":"https://sma.de"},"references":[{"category":"external","summary":"SMA PSIRT","url":"https://www.sma.de/en/cybersecurity/product-security"},{"category":"external","summary":"CERT@VDE Security Advisories for SMA","url":"https://certvde.com/en/advisories/vendor/sma/"},{"category":"self","summary":"VDE-2025-010: SMA: Sunny Portal demo system privilege escalation - HTML","url":"https://certvde.com/en/advisories/VDE-2025-010"},{"category":"self","summary":"VDE-2025-010: SMA: Sunny Portal demo system privilege escalation - CSAF","url":"https://sma.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-010.json"}],"title":"SMA: Sunny Portal demo system privilege escalation","tracking":{"aliases":["VDE-2025-010"],"current_release_date":"2025-05-14T13:00:14.000Z","generator":{"date":"2025-05-08T09:09:24.633Z","engine":{"name":"Secvisogram","version":"2.5.24"}},"id":"VDE-2025-010","initial_release_date":"2025-05-13T11:00:00.000Z","revision_history":[{"date":"2025-05-13T11:00:00.000Z","number":"1","summary":"Initial revision."},{"date":"2025-05-14T13:00:14.000Z","number":"2","summary":"Fix: added distribution"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"<20.02.2025","product":{"name":"www.sunnyportal.com <20.02.2025","product_id":"CSAFPID-51001"}},{"category":"product_version","name":"20.02.2025","product":{"name":"Software www.sunnyportal.com 20.02.2025","product_id":"CSAFPID-52001"}}],"category":"product_name","name":"www.sunnyportal.com"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"SMA Solar Technology AG"}]},"vulnerabilities":[{"cve":"CVE-2025-41645","cwe":{"id":"CWE-669","name":"Incorrect Resource Transfer Between Spheres"},"notes":[{"audience":"all","category":"description","text":"An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001"],"known_affected":["CSAFPID-51001"]},"remediations":[{"category":"vendor_fix","details":"SMA has fixed the vulnerability on the web service. No customer action required.","product_ids":["CSAFPID-52001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","environmentalScore":8.6,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":8.6,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"products":["CSAFPID-51001"]}],"title":"CVE-2025-41645"}]}