Cloud Connect Advanced
Approved changes feed: RSS · Atom
cpe:2.3:a:tigo_energy:cloud_connect_advanced:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tigo Energy (abe75ed1-3c9b-5640-aa5e-3e8f654cbaaa) |
|---|---|
| Product | Cloud Connect Advanced (7c1f3445-48bf-5a22-b331-d9883eab272e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-7770 |
vulnerable | 2026-06-08 07:45:18.191878 |
Predictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect Advanced
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.
Published: 2025-08-06T20:45:06.780Z
Updated: 2025-08-07T14:49:00.875Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7769 |
vulnerable | 2026-06-08 07:45:18.191461 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.
Published: 2025-08-06T20:42:47.338Z
Updated: 2025-08-06T20:51:40.366Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-7768 |
vulnerable | 2026-06-08 07:45:18.191098 |
Use of Hard-coded Credentials in Tigo Energy Cloud Connect Advanced
Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms.
Published: 2025-08-06T20:28:43.631Z
Updated: 2025-08-06T20:41:11.923Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.