CVE-2017-9853

CVE-2017-9853 describes a critical vulnerability affecting SMA Solar Technology inverters, specifically Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30 models. The issue stems from an extremely weak password policy, lacking complexity or length requirements, and restricting strong passwords due to a 12-character limit and limited character set. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a high-impact, easily exploitable flaw. An unauthenticated attacker can remotely compromise affected devices, leading to full confidentiality, integrity, and availability impacts. While there is no evidence of active exploitation (not in KEV or Hot List), no public exploit code (Metasploit, Nuclei, ExploitDB), and a low EPSS score, the vulnerability has garnered significant community discussion (11 mentions) and media coverage, highlighting its potential for widespread impact, including concerns about power grid disruption.