CVE-2025-15573criticalCWE-295

CVE-2025-15573: falha crítica em SolaX Power Pocket WiFi 3.0

Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

Publicada em

Seguir esta CVE+ Monitorar Pocket WiFi+ Monitorar Pocket WiFi+4GM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.2%
The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
SolaX Power · Pocket WiFi 3.0SolaX Power · Pocket WiFi 4.0SolaX Power · Pocket WiFi+4GMSolaX Power · Pocket WiFi+LANSolaX Power · Pocket WiFi+LAN 2.0
CVEs relacionadas — SolaX Power Pocket WiFi 3.0

No mesmo produto, das mais perigosas para as menos.

CVE-2025-15574MEDIUMInsecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud ConnectionEPSS 0.2%CVE-2025-15575MEDIUMMissing Firmware Authenticity Checks in Solax Power Pocket WiFi modelsEPSS 0.1%