CVE-2017-9857

CVE-2017-9857 describes a critical authentication and encryption vulnerability in the SMAdata2+ communication protocol used by specific SMA Solar Technology products, including Sunny Boy TLST-21, TL-21, Sunny Tripower TL-10, and TL-30. This flaw allows for man-in-the-middle, packet injection, and replay attacks due to the lack of proper authentication and encryption, enabling attackers to gain full control over affected devices, including changing settings and accessing hidden functionalities. With a CVSS score of 8.1 (HIGH), this vulnerability poses a significant risk of high confidentiality, integrity, and availability impacts, despite requiring high attack complexity. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion and media coverage, highlighting its potential for severe consequences, such as disrupting power grids.