CVE-2025-7768

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
Tigo EnergyCloud Connect Advanced<= 4.0.1

References

Timeline

Published
Aug 6, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-77698.7Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is calCVE-2025-77708.7Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictaCVE-2025-77718.7ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmCVE-2025-77726.5The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versCVE-2025-77738.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an inteCVE-2025-77748.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a CVE-2025-77759.8Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaleCVE-2025-77769.8Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway whCVE-2025-77776.5The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform maliciouCVE-2025-77789.8The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validatiCVE-2025-77798.8Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) beforeCVE-2025-77806.5The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTr