SMA manufactures solar inverter products across its Sunny Boy line, serving residential and commercial photovoltaic installations, and the vendor's vulnerability footprint skews strongly toward critical-severity outcomes with a notable tendency toward public exploit availability. The recurring exposure centers on firmware and web-management interfaces in models such as Sunny Boy 3.6 and 4.0, driven by weakness classes including authentication bypasses, cross-site request forgery, and improper information exposure that reflect the attack surface of internet-connected energy infrastructure. Defenders should prioritize inventory and patching of affected inverter firmware given the criticality band and the availability of exploit tooling; live exploitation status and current severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sma over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-46416HIGH Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling. | Apr 7, 2022 | 8.1 | 41 | NO | YES |
CVE-2019-13529HIGH An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmw | Oct 9, 2019 | 8.8 | 41 | NO | YES |
CVE-2017-9853CRITICAL An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length r | Aug 5, 2017 | 9.8 | 31 | NO | NO |
CVE-2017-9852CRITICAL An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be defaul | Aug 5, 2017 | 9.8 | 31 | NO | NO |
CVE-2017-9860CRITICAL An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to | Aug 5, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-9859CRITICAL An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm c | Aug 5, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-9856CRITICAL An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very si | Aug 5, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-9855CRITICAL An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers called the Grid Guard system. This system uses predictable c | Aug 5, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-9854CRITICAL An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explor | Aug 5, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-9861CRITICAL An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet in | Aug 5, 2017 | 9.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sma.
Media articles that mention a CVE ID that affects a product developed by Sma — matched by CVE ID, not by vendor name.