CVE-2025-41685
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-08-19
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sma_solar_technology_ag | sunny_portal | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41685 is a data disclosure vulnerability in SMA Solar Technology AG's Sunny Portal. A low-privileged, authenticated user can obtain the full name (username) of another registered Sunny Portal user by submitting that user's email address. This means that someone with limited access can retrieve private personal information (usernames) of other users without proper authorization. [1]
How can this vulnerability impact me? :
This vulnerability can lead to exposure of private personal information, specifically usernames, to unauthorized actors with low privileges. While it does not affect data integrity or availability, the confidentiality of user information is compromised, which could be used for further targeted attacks or social engineering. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to submit a registered user's email address to the Sunny Portal system and observing if the corresponding username is disclosed. Since it requires authentication, detection involves logging in with a low-privileged account and testing email-to-username queries against the affected Sunny Portal versions prior to 15.08.2025. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Sunny Portal software to version 15.08.2025 or later, where the vulnerability has been resolved. No further remediation action is required after applying this update. [1]