CVE-2025-15573 — Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

CVE-2025-15573

Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection PUBLISHED

Description (CNA)

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.

Affected (CNA)

Vendor / product	Versions
SolaX Power / Pocket WiFi 3.0	affected <3.022.03
SolaX Power / Pocket WiFi+LAN	affected <1.009.02
SolaX Power / Pocket WiFi+4GM	affected <1.005.05
SolaX Power / Pocket WiFi+LAN 2.0	affected <006.06
SolaX Power / Pocket WiFi 4.0	affected <003.03

CWE

CWE-295

References

https://r.sec-consult.com/solax

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.