CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-245-03: SunPower PVS6 ↗ source

September 2, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03

Summary

Successful exploitation of this vulnerability could allow attackers to gain full access to the device, enabling them to replace firmware, modify settings, disable the device, create SSH tunnels, and manipulate attached devices. CVE-2025-9696: The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-245-03
Status
Final · version 1
Initial release
2025-09-02
Last revised
2025-09-02
Vendor
SunPower
Critical infrastructure sectors
Energy
Deployed
Worldwide
Vendor headquarters
United States

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

Credit: Dagan Henderson

Affected products (1)
  • PVS6 — <=2025.06_build_61839

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2025-9696 CWE-798 Use of Hard-coded Credentials 9.6 Critical The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices.

Mitigation: SunPower did not respond to CISA's attempt to coordinate these vulnerabilities. Users should contact SunPower for more information. ↗

Affected, fixed & timeline

Affected:

  • PVS6 <=2025.06_build_61839

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2025-9696 9.4 Critical SunPower PVS6 The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. A…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.