CVE-2024-11025 | SMA Sunny Central SC 1760-US prior 10.01.18.R Administration Panel sql injection (VDE-2024-074)

A vulnerability was found in SMA Sunny Central SC 1760-US, Sunny Central SC 1850-US, Sunny Central SC 2000 EV-US, Sunny Central SC 2000-US, Sunny Central SC-2200-10, Sunny Central SC 2200-US, Sunny Central SC-2475-10, Sunny Central SC 2500 EV-US, Sunny Central SC 2660 UP, Sunny Central SC 2660 UP-US, Sunny Central SC 2750 EV-US, Sunny Central SC 2750 UP-US, Sunny Central SC 2800 UP, Sunny Central SC 2800 UP-US, Sunny Central SC 2930 UP, Sunny Central SC 2930 UP-US, Sunny Central SC 3060 UP, Sunny Central SC 3060 UP-US, Sunny Central SC 4000 UP, Sunny Central SC 4000 UP-US, Sunny Central SC 4200 UP, Sunny Central SC 4200 UP-US, Sunny Central SC 4400 UP, Sunny Central SC 4400 UP-JP, Sunny Central SC 4400 UP-US, Sunny Central SC 4600 UP, Sunny Central SC 4600 UP-US, Sunny Central Storage SCS-1900-10, Sunny Central Storage SCS-2200-10, Sunny Central Storage SCS 2300 UP-XT, Sunny Central Storage SCS 2300 UP-XT-US, Sunny Central Storage SCS 2400 UP-XT, Sunny Central Storage SCS 2400 UP-XT-US, Sunny Central Storage SCS-2475-10, Sunny Central Storage SCS 2530 UP-XT, Sunny Central Storage SCS 2530 UP-XT-US, Sunny Central Storage SCS 2630 UP-XT, Sunny Central Storage SCS 2630 UP-XT-US, Sunny Central Storage SCS-2900-10, Sunny Central Storage SCS 3450 UP, Sunny Central Storage SCS 3450 UP-US, Sunny Central Storage SCS 3450 UP-XT, Sunny Central Storage SCS 3450 UP-XT-JP, Sunny Central Storage SCS 3450 UP-XT-US, Sunny Central Storage SCS 3600 UP, Sunny Central Storage SCS 3600 UP-US, Sunny Central Storage SCS 3600 UP-XT, Sunny Central Storage SCS 3600 UP-XT-US, Sunny Central Storage SCS 3800 UP, Sunny Central Storage SCS 3800 UP-US, Sunny Central Storage SCS 3800 UP-XT, Sunny Central Storage SCS 3800 UP-XT-US, Sunny Central Storage SCS 3950 UP, Sunny Central Storage SCS 3950 UP-US, Sunny Central Storage SCS 3950 UP-XT and Sunny Central Storage SCS 3950 UP-XT-US. It has been rated as critical. Affected by this issue is some unknown functionality of the component Administration Panel. The manipulation leads to sql injection.

This vulnerability is handled as CVE-2024-11025. The attack may be launched remotely. There is no exploit available.

It is recommended to upgrade the affected component.