Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-50688: SunGrow iSolarCloud Android App Exposes Sensitive Credentials
CVE-2024-50688 · published 1 year ago
Summary
The SunGrow iSolarCloud Android app stores sensitive login credentials in plain text, which can be accessed by unauthorized parties. This can lead to unauthorized access to user accounts and the cloud system. Update the app to the latest version to fix the issue.
What to do
- Update sungrowpower isolarcloud to version 2.1.6.20241104 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sungrowpower | isolarcloud |
< 2.1.6.20241104 cpe:2.3:a:sungrowpower:isolarcloud:*:*:*:*:*:android:*:* |
Original advisory text
SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for e...
SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for exchanging the device telemetry.
References
- https://en.sungrowpower.com/security-notice-detail-2/6122 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published26 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-50688 · NVD
Track software like this
Free during beta