EG4 Electronics Inverters Product Registration Status Information Disclosure Vulnerability

A vulnerability exists in the public-facing product registration endpoint of EG4 Electronics inverters. The server's response varies based on the registration status of the serial number (S/N), which is assigned sequentially. This discrepancy allows an attacker to infer the registration status of different S/Ns. The vulnerability affects all versions of the following EG4 inverters: 12kPV, 18kPV, Flex 21, Flex 18, 6000XP, 12000XP, and GridBoss.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure regarding the product registration status of various serial numbers, potentially allowing for targeted attacks based on this information.