What’s Vulnerable › Vulnerabilities

CVE-2019-19228

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-04 · updated 2026-06-17
• Weakness: CWE-312

Description

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.

Affected products

• Fronius Datamanager Box 2.0 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Eco 25.0-3-S Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Eco 27.0-3-S Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 1.5-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 1.5-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 2.0-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 2.0-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 2.5-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 2.5-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 3.0-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 3.1-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Galvo 3.1-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 10.0-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 11.4-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 12.5-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 15.0-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 3.0-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 3.5-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 3.6-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 3.8-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 4.0-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 4.6-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 5.0-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 5.0-1 Aus Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 5.0-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 5.0-1 Sc Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 6.0-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 6.0-1 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 7.6-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1
• Fronius Primo 8.2-1 208-240 Firmware: before 3.14.1 — fixed in 3.14.1

How to fix

Upgrade to a fixed version: Fronius Datamanager Box 2.0 Firmware 3.14.1; Fronius Eco 25.0-3-S Firmware 3.14.1; Fronius Eco 27.0-3-S Firmware 3.14.1; Fronius Galvo 1.5-1 208-240 Firmware 3.14.1; Fronius Galvo 1.5-1 Firmware 3.14.1; Fronius Galvo 2.0-1 208-240 Firmware 3.14.1; Fronius Galvo 2.0-1 Firmware 3.14.1; Fronius Galvo 2.5-1 208-240 Firmware 3.14.1; Fronius Galvo 2.5-1 Firmware 3.14.1; Fronius Galvo 3.0-1 Firmware 3.14.1; Fronius Galvo 3.1-1 208-240 Firmware 3.14.1; Fronius Galvo 3.1-1 Firmware 3.14.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
• https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/
• https://seclists.org/bugtraq/2019/Dec/5
• http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
• https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/
• https://seclists.org/bugtraq/2019/Dec/5

Get alerted when CVE-2019-19228 or the next vulnerability affects your stack