CVE-2025-7769
highpriority · track · 17EPSS 0.194 · 97 %ileexploit · PoCEURUUSEPSS · scored 2026-10-27
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationCloud Connect Advancedcisa_csaf_ot
Tigo Energy is aware of these vulnerabilities and is actively working on a fix to address them.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-25-217-02Tigo Energy Cloud Connect Advanced (Update A)2025-08-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative access using hard-coded credentials, escalate privileges to take full control of the device, modify system settings, disrupt solar energy production, interfere with safety mechanisms, execute arbitrary commands via command injection, cause service disruptions, expose sensitive data, and recreate valid session IDs to access sensitive device functions on connected solar inverter systems due to insecure session ID generation.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02cnnvd
- https://www.exploit-db.com/exploits/52404cnnvd
- https://zh.tigoenergy.com/product/cloud-connect-advancedPatchcnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan