{"cve":"CVE-2017-9853","nvd":{"published":"2017-08-05T17:29:00.490","modified":"2026-06-17T01:29:02.810","status":"Modified","description":"An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of characters. NOTE: the vendor reports that the 12-character limit provides \"a very high security standard.\" Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-521"],"references":["http://www.sma.de/en/statement-on-cyber-security.html","http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf","https://horusscenario.com/CVE-information/","http://www.sma.de/en/statement-on-cyber-security.html","http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf"],"products":["sma:sunny_boy_1.5_firmware","sma:sunny_boy_2.5_firmware","sma:sunny_boy_3.0_firmware","sma:sunny_boy_3.6_firmware","sma:sunny_boy_3000tl_firmware","sma:sunny_boy_3600_firmware","sma:sunny_boy_3600tl_firmware","sma:sunny_boy_4.0_firmware","sma:sunny_boy_4000tl_firmware","sma:sunny_boy_5.0_firmware","sma:sunny_boy_5000_firmware","sma:sunny_boy_5000tl_firmware","sma:sunny_boy_storage_2.5_firmware","sma:sunny_central_1000cp_xt_firmware","sma:sunny_central_2200_firmware","sma:sunny_central_500cp_xt_firmware","sma:sunny_central_630cp_xt_firmware","sma:sunny_central_720cp_xt_firmware","sma:sunny_central_760cp_xt_firmware","sma:sunny_central_800cp_xt_firmware","sma:sunny_central_850cp_xt_firmware","sma:sunny_central_900cp_xt_firmware","sma:sunny_central_storage_1000_firmware","sma:sunny_central_storage_2200_firmware","sma:sunny_central_storage_2500-ev_firmware","sma:sunny_central_storage_500_firmware","sma:sunny_central_storage_630_firmware","sma:sunny_central_storage_720_firmware","sma:sunny_central_storage_760_firmware","sma:sunny_central_storage_800_firmware","sma:sunny_central_storage_850_firmware","sma:sunny_central_storage_900_firmware","sma:sunny_tripower_12000tl_firmware","sma:sunny_tripower_15000tl_firmware","sma:sunny_tripower_20000tl_firmware","sma:sunny_tripower_25000tl_firmware","sma:sunny_tripower_5000tl_firmware","sma:sunny_tripower_60_firmware","sma:sunny_tripower_core1_firmware"],"source":"nvd","synced_at":"2026-10-19T20:44:47.710380879+00:00"},"epss":{"cve":"CVE-2017-9853","score":0.01716,"percentile":0.77422,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}