Multiple vulnerabilities in I-Panda SolarEagle - Solar Controller Administration

SEC Consult Vulnerability Lab Security Advisory < 20161114-0 >

=======================================================================

title: Multiple vulnerabilities

product: I-Panda SolarEagle - Solar Controller Administration

Software / MPPT Solar Controller SMART2

vulnerable version: SolarEagle V2.00 / MPPT Solar Controller SMART2

fixed version: -

CVE number: -

impact: Medium

homepage: www.solarcontroller-inverter.com

found: 2016-09-03

by: T. Weber (Office Vienna)

SEC Consult Vulnerability Lab

 

An integrated part of SEC Consult

Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow

Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

 

www.sec-consult.com

=======================================================================

 

Vendor description:

-------------------

"ShenZhen I-Panda Electronics Co. Ltd. is developing power supply devices

such as UPS, power adapter and power inverter and also equipment for solar

systems. This equipment produced by I-Panda comprises solar panels/

controllers/inverters and also solar generator systems."

 

Source: www.solarcontroller-inverter.com/about-us.html

 

 

Business recommendation:

------------------------

SEC Consult recommends not to use this product until a thorough security

review has been performed by security professionals and all identified

issues have been resolved.

 

 

Vulnerability overview/description:

-----------------------------------

1) Broken Local Admin Authentication in SolarEagle V2.00

Attackers which have access to the locally installed software are able to

bypass the administrative login and can control the MPPT Solar Controller.

 

2) Missing Server Side Authentication in MPPT Solar Controller SMART2

Attackers which have access to the local network can send their own commands

to the MPPT Solar Controller and are able to control the device this way.

 

3) Unencrypted Communication in MPPT Solar Controller SMART2

Eavesdropping the communication is possible since unencrypted TCP is used

for all packets which are transferred between the controller and SolarEagle.

 

4) Denial of Service in MPPT Solar Controller SMART2

Attackers are able to disrupt an active connection as long as they want.

 

 

Proof of concept:

-----------------

The vendor was not responsive, hence there is no fix available. The proof of

concept has been removed from this advisory.

 

 

Vulnerable / tested versions:

-----------------------------

SolarEagle V2.00 / MPPT Solar Controller SMART2

 

 

Vendor contact timeline:

------------------------

2016-09-12: Contacting vendor through email, sending responsible disclosure

policy, defining release deadline (10th November), asking for

encryption keys

2016-09-13: Contacting vendor through email, sending responsible disclosure

policy, defining release deadline (10th November), asking for

encryption keys

2016-09-13: Vendor: (Instant-Messenger) No encryption available. Offer to

send the advisory unencrypted; No Answer

2016-10-29: Offer to send the advisory unencrypted; No Answer

2016-11-03: Offer to send the advisory unencrypted; No Answer

2016-11-14: SEC Consult releases security advisory

 

 

Solution:

---------

There is no fix available from the vendor as they did not respond.

 

 

Workaround:

-----------

No workaround

 

 

Advisory URL:

-------------

www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

SEC Consult Vulnerability Lab

 

SEC Consult

Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow

Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

 

About SEC Consult Vulnerability Lab

The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It

ensures the continued knowledge gain of SEC Consult in the field of network

and application security to stay ahead of the attacker. The SEC Consult

Vulnerability Lab supports high-quality penetration testing and the evaluation

of new offensive and defensive technologies for our customers. Hence our

customers obtain the most current information about vulnerabilities and valid

recommendation about the risk profile of new technologies.

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Interested to work with the experts of SEC Consult?

Send us your application www.sec-consult.com/en/Career.htm

 

Interested in improving your cyber security with the experts of SEC Consult?

Contact our local offices www.sec-consult.com/en/About/Contact.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Mail: research at sec-consult dot com

Web: www.sec-consult.com

Blog: blog.sec-consult.com

Twitter: twitter.com/sec_consult

 

EOF T. Weber / @2016