CVE-2020-9306
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials"...
CVE-2020-9306 is a high vulnerability (CVSS 8.8) in Tesla Solarcity Solar Monitoring Gateway, published February 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 68th percentile. No source names a fixed version.
- Severity
- 8.8 HighCVSS 3.1, CVE List
- Exploit chance
- 1.18%EPSS, 68th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
What each source reports
CVE List Score used
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
- Record
CVE-2020-9306- CVSS 3.1
- 8.8 High
CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2020-30130
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
- Record
EUVD-2020-30130- CVSS 3.1
- 8.8 High
CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwqr-4q2w-739qNo score
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials"...
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
- Record
GHSA-vwqr-4q2w-739q- Weakness
- CWE-798
- Updated
- 2026-11-02
NVD
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
- Record
CVE-2020-9306- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:A/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-522, CWE-798
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
fireeye.com/blog/threat-research.html
github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0019/FEYE-2020-0019.md
nvd.nist.gov/vuln/detail/CVE-2020-9306