CVE-2021-46416

HighCVSS 8.1/10Last modified Jul 13, 2026

Description

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.htmlExploit, Third Party Advisory, VDB Entry
https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharingExploit, Third Party Advisory
https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.htmlProduct, Vendor Advisory
http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.htmlExploit, Third Party Advisory, VDB Entry
https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharingExploit, Third Party Advisory
https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.htmlProduct, Vendor Advisory
http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.htmlExploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 7, 2022
Last modified: Jul 13, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-464177.5Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fuelin CVE-2021-464187.5An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.CVE-2021-464199.1An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.CVE-2021-464207.5Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability, which allows an att CVE-2021-464217.5Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, which allows an attac CVE-2021-464229.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without CVE-2021-464235.3Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full CVE-2021-464249.1Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even CVE-2021-464266.1phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.CVE-2021-464279.8An SQL Injection vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 via the message parameter in Master.php.CVE-2021-464289.8A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avat CVE-2021-4643310.0In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary