{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]},{"names":["Francesco La Spina"],"organization":"Forescout Technologies Inc. ","summary":"reporting","urls":["https://www.forescout.com"]}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"audience":"csaf creator","category":"other","text":"[CERT@VDE CSAF Template](https://github.com/CERTVDE/CSAF-Template) © 2024 by [CERT@VDE](https://certvde.com) is licensed under [CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) \n\nThis document note may only be removed in order to create a CSAF advisory based on this template.","title":"LICENSE"},{"category":"summary","text":"A security researcher discovered a critical Remote Code Execution vulnerability in sunnyportal.com.\nAn attacker could upload code instead of an image and remotely execute this code.","title":"Summary"},{"category":"description","text":"An unauthenticated attacker could upload code instead of an image in the demo section of the portal and can remotely execute this code.","title":"Impact"},{"category":"description","text":"No action required. The vulnerability was closed in the portal on December, 19, 2024.","title":"Remediation"},{"category":"description","text":"Sunny Portal is an online portal for SMA customers to monitor their PV Systems","title":"Product Description"}],"publisher":{"category":"vendor","contact_details":"information-security@sma.de","name":"SMA Solar Technology AG","namespace":"https://sma.de"},"references":[{"category":"external","summary":"SMA PSIRT","url":"https://www.sma.de/en/cybersecurity/product-security"},{"category":"external","summary":"CERT@VDE Security Advisories for SMA","url":"https://certvde.com/en/advisories/vendor/sma/"},{"category":"self","summary":"VDE-2025-012: SMA: Sunny Portal Remote Code Execution - HTML","url":"https://certvde.com/en/advisories/VDE-2025-012"},{"category":"self","summary":"VDE-2025-012: SMA: Sunny Portal Remote Code Execution - CSAF","url":"https://sma.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-012.json"}],"title":"SMA: Sunny Portal Remote Code Execution","tracking":{"aliases":["VDE-2025-012"],"current_release_date":"2025-05-22T13:03:10.000Z","generator":{"date":"2025-02-28T13:40:20.075Z","engine":{"name":"Secvisogram","version":"2.5.18"}},"id":"VDE-2025-012","initial_release_date":"2025-02-26T11:00:00.000Z","revision_history":[{"date":"2025-02-26T11:00:00.000Z","number":"1","summary":"Initial revision."},{"date":"2025-02-28T14:00:00.000Z","number":"2","summary":"Update: Changed Date in Remediation"},{"date":"2025-04-10T13:00:00.000Z","number":"3","summary":"fixed document status, csaf reference URL"},{"date":"2025-05-22T13:03:10.000Z","number":"4","summary":"Fix: added distribution, quotation mark"}],"status":"final","version":"4"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"<19.12.2024","product":{"name":"www.sunnyportal.com <19.12.2024","product_id":"CSAFPID-51001"}},{"category":"product_version","name":"19.12.2024","product":{"name":"Software www.sunnyportal.com 19.12.2024","product_id":"CSAFPID-52001"}}],"category":"product_name","name":"www.sunnyportal.com"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"SMA Solar Technology AG"}]},"vulnerabilities":[{"cve":"CVE-2025-0731","cwe":{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"},"notes":[{"audience":"all","category":"description","text":"An unauthenticated remote attacker can upload a '.aspx' file  instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.\n","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001"],"known_affected":["CSAFPID-51001"]},"remediations":[{"category":"vendor_fix","date":"2024-12-19T11:00:00.000Z","details":"SMA has fixed the vulnerability on the web service. No customer action required.","product_ids":["CSAFPID-52001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","environmentalScore":6.5,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":6.5,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["CSAFPID-51001"]}],"title":"CVE-2025-0731"}]}