SMA Sunny Portal Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in SMA Sunny Portal versions prior to 19.12.2024. This vulnerability allows an unauthenticated remote attacker to upload a .aspx file instead of a PV system picture through the demo account. The uploaded code can be executed, but only in the security context of the user.

Impact

Exploitation of this vulnerability allows for remote code execution on the server, with the executed code running in the context of the user.

Remediation

The vulnerability has been addressed, and no action is required. Users should ensure they are using a version of Sunny Portal released after December 19, 2024.