What’s Vulnerable › Vulnerabilities

CVE-2025-52586: EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information

• Severity: medium (CVSS 6.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-08 · updated 2026-06-17
• Weakness: CWE-319

Description

The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operational status, alarms, telemetry, system reset, or inverter control commands, potentially disrupting power generation or reconfiguring inverter settings.

Affected products

• EG4 Electronics EG4 12000XP: all versions
• EG4 Electronics EG4 12kPV: all versions
• EG4 Electronics EG4 18kPV: all versions
• EG4 Electronics EG4 6000XP: all versions
• EG4 Electronics EG4 Flex 18: all versions
• EG4 Electronics EG4 Flex 21: all versions
• EG4 Electronics EG4 GridBoss: all versions

References

• https://eg4electronics.com/contact/
• https://eg4electronics.com/wp-content/uploads/2025/09/EG4-Wi-Fi-Dongle-Dongle-Firmware-Update.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07

Get alerted when CVE-2025-52586 or the next vulnerability affects your stack