CVE-2025-15573: Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

Severity: critical (CVSS 9.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-12 · updated 2026-06-17
Weakness: CWE-295

Description

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.

Affected products

SolaX Power Pocket WiFi+4GM: before 1.005.05
SolaX Power Pocket WiFi+LAN: before 1.009.02
SolaX Power Pocket WiFi+LAN 2.0: before 006.06
SolaX Power Pocket WiFi 3.0: before 3.022.03
SolaX Power Pocket WiFi 4.0: before 003.03

References

https://r.sec-consult.com/solax

Get alerted when CVE-2025-15573 or the next vulnerability affects your stack