PatchTheCVECVE-2024-50692: SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacke
CVE-2024-50692 is a medium-severity flaw (CVSS 5.4) affecting winet-s firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT communications are vulnerable to MitM attacks at the TCP/IP level.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 84%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2025-01-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-50692?
winet-s firmware: upgrade to 200.001.00.p027. Exact commands for each OS are on this page.
Is CVE-2024-50692 being exploited?
CVE-2024-50692 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-50692 affect?
CVE-2024-50692 affects winet-s firmware. Severity is medium (CVSS 5.4). SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to i
How urgent is CVE-2024-50692?
Priority 23/100. No elevated risk signals yet.
Related CVEs
- CVE-2024-50698 CRITICAL 9.8 UPGRADE SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds
- CVE-2024-50697 HIGH 8.1 UPGRADE In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses s
- CVE-2024-50696 HIGH 7.5 UPGRADE SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades
- CVE-2024-50695 CRITICAL 9.8 UPGRADE SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing
- CVE-2024-50694 CRITICAL 9.8 UPGRADE In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message,