{"id":"CVE-2025-15574","aliases":["EUVD-2025-207388","GHSA-rmgp-99fm-wv32"],"status":"published","title":"Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection","description":"When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the \"registration number\" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0021,"percentile":0.11266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-330"],"published":"2026-02-12T10:58:29Z","modified":"2026-06-17T08:38:03Z","products":[{"vendor":"solax power","product":"pocket wifi 3.0"},{"vendor":"solax power","product":"pocket wifi 4.0"},{"vendor":"solax power","product":"pocket wifi+4gm"},{"vendor":"solax power","product":"pocket wifi+lan"},{"vendor":"solax power","product":"pocket wifi+lan 2.0"}],"references":[{"url":"https://r.sec-consult.com/solax"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15574"},{"url":"https://github.com/advisories/GHSA-rmgp-99fm-wv32"}],"sources":{"cve":[{"id":"CVE-2025-15574","title":"Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection","description":"When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the \"registration number\" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters.","status":"published","published":"2026-02-12T10:58:29.373Z","modified":"2026-02-12T15:15:45.817Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-207388","description":"When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the \"registration number\" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters.","status":"published","published":"2026-02-12T10:58:29Z","modified":"2026-02-12T15:15:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:40.418792Z"}],"ghsa":[{"id":"GHSA-rmgp-99fm-wv32","title":"When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which...","description":"When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the \"registration number\" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters.","status":"published","published":"2026-02-12T12:31:00Z","modified":"2026-02-12T18:30:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:06:11.04945Z"}],"nvd":[{"id":"CVE-2025-15574","description":"When connecting to the Solax Cloud MQTT server the username is the \"registration number\", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the \"registration number\" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters.","status":"published","published":"2026-02-12T11:15:49.117Z","modified":"2026-06-17T08:38:03.54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:12:00.273026Z"}]}}