Sungrow WiNet-S Buffer Overflow Vulnerability in MQTT Message Decryption Allowing Denial-of-Service and Remote Code Execution

A stack-based buffer overflow vulnerability has been identified in the SunGrow WiNet-SV200.001.00.P027 firmware and earlier versions. The issue arises during the decryption of MQTT messages, where the code responsible for parsing certain TLV fields lacks adequate bounds checks. This vulnerability could be exploited to cause a denial-of-service condition or to execute arbitrary code remotely.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, causing a denial-of-service condition and/or allowing for remote code execution.

Remediation

Users are advised to upgrade to WiNet-SV200.001.00.P028 or higher.