Description (CNA)
The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operational status, alarms, telemetry, system reset, or inverter control commands, potentially disrupting power generation or reconfiguring inverter settings.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| EG4 Electronics / EG4 12kPV | affected all versions |
| EG4 Electronics / EG4 18kPV | affected all versions |
| EG4 Electronics / EG4 Flex 21 | affected all versions |
| EG4 Electronics / EG4 Flex 18 | affected all versions |
| EG4 Electronics / EG4 6000XP | affected all versions |
| EG4 Electronics / EG4 12000XP | affected all versions |
| EG4 Electronics / EG4 GridBoss | affected all versions |
CWE
CWE-319
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
- https://eg4electronics.com/contact/
- https://eg4electronics.com/wp-content/uploads/2025/09/EG4-Wi-Fi-Dongle-Dongle-Firmware-Update.pdf
ADP enrichment
No English description supplied.
No references supplied.