Sign-up

ID

VAR-201509-0445


CVE

CVE-2015-3964


TITLE

SMA Solar Sunny WebBox Vulnerabilities that gain access

Trust: 0.8

sources: JVNDB: JVNDB-2015-004691

DESCRIPTION

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. http://cwe.mitre.org/data/definitions/798.htmlAccess may be obtained by a third party. The SMA Solar Sunny WebBox is a device from SMA Germany for remote monitoring and maintenance of large and medium-sized PV plants. Sunny WebBox is prone to a security-bypass vulnerability

Trust: 2.52

sources: NVD: CVE-2015-3964 // JVNDB: JVNDB-2015-004691 // CNVD: CNVD-2015-06020 // BID: 76617 // VULHUB: VHN-81925

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-06020

AFFECTED PRODUCTS

vendor:sma solarmodel:webboxscope:eqversion: -

Trust: 1.6

vendor:sma solarmodel:sunny webboxscope: - version: -

Trust: 0.8

vendor:smamodel:sunny webboxscope: - version: -

Trust: 0.6

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.46

Trust: 0.3

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.45

Trust: 0.3

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.44

Trust: 0.3

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.43

Trust: 0.3

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.42

Trust: 0.3

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.41

Trust: 0.3

vendor:smamodel:solar technology ag sunny webboxscope:eqversion:1.40

Trust: 0.3

sources: CNVD: CNVD-2015-06020 // BID: 76617 // JVNDB: JVNDB-2015-004691 // CNNVD: CNNVD-201509-142 // NVD: CVE-2015-3964

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-3964
value: HIGH

Trust: 1.0

NVD: CVE-2015-3964
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-06020
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201509-142
value: CRITICAL

Trust: 0.6

VULHUB: VHN-81925
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-3964
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-06020
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-81925
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-06020 // VULHUB: VHN-81925 // JVNDB: JVNDB-2015-004691 // CNNVD: CNNVD-201509-142 // NVD: CVE-2015-3964

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2015-004691 // NVD: CVE-2015-3964

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201509-142

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201509-142

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-004691

PATCH
title:トップページurl:http://www.sma-japan.com/
Trust: 0.8
title:Patch for SMA Solar Sunny WebBox Access Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/63988
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-06020 // 
            
            
            
            JVNDB: JVNDB-2015-004691

EXTERNAL IDS
db:NVDid:CVE-2015-3964
Trust: 3.4
db:ICS CERTid:ICSA-15-181-02
Trust: 3.4
db:JVNDBid:JVNDB-2015-004691
Trust: 0.8
db:CNNVDid:CNNVD-201509-142
Trust: 0.7
db:CNVDid:CNVD-2015-06020
Trust: 0.6
db:BIDid:76617
Trust: 0.4
db:VULHUBid:VHN-81925
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-06020 // 
            
            
            
            VULHUB: VHN-81925 // 
            
            
            
            BID: 76617 // 
            
            
            
            JVNDB: JVNDB-2015-004691 // 
            
            
            
            CNNVD: CNNVD-201509-142 // 
            
            
            
            NVD: CVE-2015-3964

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-15-181-02
Trust: 3.4
url:http://seclists.org/fulldisclosure/2015/sep/51
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3964
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3964
Trust: 0.8
url:http://www.sma-america.com/products/monitoring-control/sunny-webbox.html#release-notes-165757
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2015-06020 // 
            
            
            
            VULHUB: VHN-81925 // 
            
            
            
            BID: 76617 // 
            
            
            
            JVNDB: JVNDB-2015-004691 // 
            
            
            
            CNNVD: CNNVD-201509-142 // 
            
            
            
            NVD: CVE-2015-3964

CREDITS
Aleksandr Timorin of PT Security
Trust: 0.3
sources:
            
            
            BID: 76617

SOURCES
db:CNVDid:CNVD-2015-06020
db:VULHUBid:VHN-81925
db:BIDid:76617
db:JVNDBid:JVNDB-2015-004691
db:CNNVDid:CNNVD-201509-142
db:NVDid:CVE-2015-3964

LAST UPDATE DATE
2025-04-12T23:15:38.661000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-06020date:2015-09-16T00:00:00
db:VULHUBid:VHN-81925date:2016-12-22T00:00:00
db:BIDid:76617date:2015-09-03T00:00:00
db:JVNDBid:JVNDB-2015-004691date:2015-09-15T00:00:00
db:CNNVDid:CNNVD-201509-142date:2015-09-18T00:00:00
db:NVDid:CVE-2015-3964date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-06020date:2015-09-16T00:00:00
db:VULHUBid:VHN-81925date:2015-09-11T00:00:00
db:BIDid:76617date:2015-09-03T00:00:00
db:JVNDBid:JVNDB-2015-004691date:2015-09-15T00:00:00
db:CNNVDid:CNNVD-201509-142date:2015-09-14T00:00:00
db:NVDid:CVE-2015-3964date:2015-09-11T16:59:03.673