CVE-2024-50695

CVE-2024-50695 is a stack-based buffer overflow vulnerability in SunGrow WiNet-SV200 versions 001.00.P027 and earlier. The issue arises when parsing MQTT messages due to missing bounds checks on MQTT topics, classified under CWE-121 (Stack-based Buffer Overflow). It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its critical severity.

An unauthenticated attacker with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation of the buffer overflow could result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution or system crashes on affected devices.

Sungrow has issued a security notice detailing the vulnerability at https://en.sungrowpower.com/security-notice-detail-2/5961. Practitioners should consult this advisory for mitigation guidance and patch availability.