What’s Vulnerable › Vulnerabilities

CVE-2021-46416

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-07 · updated 2026-07-13
• Weakness: CWE-639

Description

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.

Affected products

• SMA Sunny Tripower Firmware: 3.10.16.r

References

• http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
• https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing
• https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
• http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html
• https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing
• https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
• http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html

Get alerted when CVE-2021-46416 or the next vulnerability affects your stack