What’s Vulnerable › Vulnerabilities

CVE-2024-11025: SMA: SQL injection in Sunny Central UP

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-27 · updated 2026-06-17
• Weakness: CWE-89

Description

An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.

Affected products

• SMA Sunny Central SC-2200-10: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC-2475-10: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 1760-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 1850-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2000-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2000 EV-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2200-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2500 EV-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2660 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2660 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2750 EV-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2750 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2800 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2800 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2930 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 2930 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 3060 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 3060 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4000 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4000 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4200 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4200 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4400 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4400 UP-JP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4400 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4600 UP: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central SC 4600 UP-US: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central Storage SCS-1900-10: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central Storage SCS-2200-10: before 10.01.18.R — fixed in 10.01.18.R
• SMA Sunny Central Storage SCS-2475-10: before 10.01.18.R — fixed in 10.01.18.R

How to fix

Upgrade to a fixed version: SMA Sunny Central SC-2200-10 10.01.18.R; SMA Sunny Central SC-2475-10 10.01.18.R; SMA Sunny Central SC 1760-US 10.01.18.R; SMA Sunny Central SC 1850-US 10.01.18.R; SMA Sunny Central SC 2000-US 10.01.18.R; SMA Sunny Central SC 2000 EV-US 10.01.18.R; SMA Sunny Central SC 2200-US 10.01.18.R; SMA Sunny Central SC 2500 EV-US 10.01.18.R; SMA Sunny Central SC 2660 UP 10.01.18.R; SMA Sunny Central SC 2660 UP-US 10.01.18.R; SMA Sunny Central SC 2750 EV-US 10.01.18.R; SMA Sunny Central SC 2750 UP-US 10.01.18.R. Check the vendor advisory for mitigations.

References

• https://certvde.com/en/advisories/VDE-2024-074

Get alerted when CVE-2024-11025 or the next vulnerability affects your stack