CVE-2017-9852

CVE-2017-9852 describes an Incorrect Password Management vulnerability (CWE-798) in specific SMA Solar Technology products, namely Sunny Boy TLST-21, TL-21, and Sunny Tripower TL-10, TL-30. The issue stems from the pervasive use of default, rarely changed passwords for users and installers, and fixed, unchangeable passwords for hidden accounts, which can be discovered through other vulnerabilities. This critical vulnerability, rated 9.8 CVSS, allows unauthenticated remote attackers to achieve full compromise (confidentiality, integrity, availability) with low attack complexity. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media attention, indicating potential interest from threat actors.