SMA Solar Sunny WebBox Default Credentials weak authenticati

CVE: CVE-2015-3964
ICSA-15-181-02

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.

AFFECTED PRODUCTS

The following Sunny WebBox versions are affected:

    Sunny WebBox – All versions.

IMPACT

A remote attacker could exploit this vulnerability to gain full access to the system.

Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.
BACKGROUND

SMA Solar Technology AG is a German solar energy equipment supplier.

The affected product, Sunny WebBox, is used for remote monitoring and maintenance of medium-sized photovoltaic plants. According to SMA, Sunny WebBox devices are deployed in the Energy sector. SMA estimates that this product is used worldwide.


VULNERABILITY CHARACTERIZATION
VULNERABILITY OVERVIEW
USE OF HARD-CODED CREDENTIALSa

Sunny WebBox can be accessed using hard-coded passwords that cannot be changed or disabled by a user.

CVE-2015-3964b has been assigned to this vulnerability. A CVSS v2 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:N/C:C/I:C/A:C).c
VULNERABILITY DETAILS
EXPLOITABILITY

This vulnerability could be(will be) exploited remotely.
EXISTENCE OF EXPLOIT ++++ TRY SWBwfri2004!  ++++

No known public exploits specifically target this vulnerability.
DIFFICULTY

An attacker with a low skill would be able to exploit this vulnerability.
MITIGATION

SMA Solar Technology AG has sent out security recommendations via its Sunny Portal Online Platform to WebBox users. It recommends using port-forwarding or a VPN to access these devices remotely. Please refer to the Sunny Portal Online Platform or contact SMA customer service for more information:

Phone: 1-888-4SMAUSA
Email: [email protected] (link sends e-mail)
Web: www.SMA-America.com (link is external)

ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should remove and replace this system.

ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.