CVE-2023-35835: solax pocket wifi 3 firmware

csirt@kutim:~/threat-intel/cve/CVE-2023-35835

CVSS 9.8 · Critical EPSS 0,51%

Kerentanan pada solax pocket wifi 3 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial configuration. The WiFi network provided has no network authentication (such as an encryption key) and persists permanently, including after enrollment and setup is complete. The WiFi network serves a web-based configuration utility, as well as an unauthenticated ModBus protocol interface.

Rincian

Terbit di NVD: 23 Januari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 0,51% peluang dieksploitasi; lebih tinggi dari 41,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
solax	pocket wifi 3 firmware	Versi 3.0.0 hingga 3.009.03_20230504

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://yougottahackthat.com/blog/ advisory pihak ketiga
https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication advisory pihak ketiga
https://www.solaxpower.com/downloads/ not applicable
https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware/ not applicable

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.