CVE-2017-9860

CVE-2017-9860 describes a critical unauthenticated firmware update vulnerability in specific SMA Solar Technology products, including Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30 inverters. With a CVSS score of 9.8 (Critical), an unauthenticated attacker can remotely upload malicious firmware, potentially leading to complete device compromise, botnet creation, or network pivot points. While the vendor claims an integrity check prevents exploitation, the potential impact is severe, as highlighted by media coverage suggesting power grid disruption. There is no public exploit code available, and community discussion is limited, indicating low current exploitation activity.