CVE-2025-15575

Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models

CVSS 5.3 MEDIUMEPSS 0.1%CWE-494

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

12 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

SolaX Power · Pocket WiFi 3.0 SolaX Power · Pocket WiFi 4.0 SolaX Power · Pocket WiFi+4GM SolaX Power · Pocket WiFi+LAN SolaX Power · Pocket WiFi+LAN 2.0

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://r.sec-consult.com/solax