What’s Vulnerable › Vulnerabilities

CVE-2021-4459: SMA: Directory Traversal in Sunny Boy <3.10.27.R

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-27 · updated 2026-06-17
• Weakness: CWE-23

Description

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

Affected products

• SMA Boy 3.0: before 3.10.27.R — fixed in 3.10.27.R
• SMA Boy 3.6: before 3.10.27.R — fixed in 3.10.27.R
• SMA Boy 4.0: before 3.10.27.R — fixed in 3.10.27.R
• SMA Boy 5.0: before 3.10.27.R — fixed in 3.10.27.R
• SMA Boy 6.0: before 3.10.27.R — fixed in 3.10.27.R

How to fix

Upgrade to a fixed version: SMA Boy 3.0 3.10.27.R; SMA Boy 3.6 3.10.27.R; SMA Boy 4.0 3.10.27.R; SMA Boy 5.0 3.10.27.R; SMA Boy 6.0 3.10.27.R. Check the vendor advisory for mitigations.

References

• https://certvde.com/en/advisories/VDE-2025-066

Get alerted when CVE-2021-4459 or the next vulnerability affects your stack