Sungrow WiNet-S Improper Firmware Integrity Check Vulnerability

A vulnerability exists in Sungrow WiNet-S versions V200.001.00.P025 and earlier, due to the absence of proper integrity checks during firmware updates. This flaw allows an attacker to send a specific MQTT message that triggers the installation of a fraudulent firmware file from an attacker-controlled server onto an inverter or a WiNet connectivity dongle. The exploitation of this vulnerability could lead to unauthorized modifications, control of the device, or potentially bricking it.

Impact

Exploitation of this vulnerability could result in malicious modifications to the firmware, unauthorized control over the affected device, or causing the device to become inoperable.

Remediation

Users are advised to upgrade to firmware version WINET-SV200.001.00.P026 or higher. A patch is currently available. As a temporary measure, network access can be restricted to prevent unauthorized firmware installations until the upgrade is completed.