CVE-2024-28756

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to read and alter all network traffic between the application and the server.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
solaredge	mysolaredge	< 2.20.1

References

https://www.solaredge.com/coordinated-vulnerability-disclosure-policy/advisories/sedg-2024-1Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-012.txtExploit, Third Party Advisory
https://www.solaredge.com/coordinated-vulnerability-disclosure-policy/advisories/sedg-2024-1Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-012.txtExploit, Third Party Advisory

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-287577.5libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityP CVE-2024-287594.3A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.CVE-2024-28769.8The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-287604.3IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to i CVE-2024-287615.4IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker coul CVE-2024-287626.5IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially c CVE-2024-287647.8IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could CVE-2024-287655.3IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sen CVE-2024-287667.5IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about direc CVE-2024-287678.8IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute ar CVE-2024-28775.5Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on th CVE-2024-287706.5IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorizati