CVE-2017-9859

CVE-2017-9859 describes a critical vulnerability in SMA Solar Technology's Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30 inverters, stemming from their use of a weak hashing algorithm for REGISTER request passwords. This flaw allows attackers to easily crack passwords offline, potentially gaining unauthorized access to SMA servers. With a CVSS score of 9.8 (Critical), the vulnerability presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, no public exploit code, and it is not listed in KEV, the vulnerability has garnered significant community discussion and media coverage, indicating awareness despite the vendor's assessment of low manipulation probability.