Minimizing network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locating control system networks and remote devices behind firewalls and isolating them from business networks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Anthony Rose, Jacob Krasnov (BC Security); Peter Kariuki (Ovanova)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-7768 | CWE-798 Use of Hard-coded Credentials | 9.8 Critical |
Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms. Mitigation: Tigo Energy is aware of these vulnerabilities and is actively working on a fix to address them. Mitigation: Visit Tigo Energy's Help Center for more specific security recommendations. ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-7769 | CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') | 8.8 High |
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure. Mitigation: Tigo Energy is aware of these vulnerabilities and is actively working on a fix to address them. Mitigation: Visit Tigo Energy's Help Center for more specific security recommendations. ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-7770 | CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG) | 8.8 High |
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems. Mitigation: Tigo Energy is aware of these vulnerabilities and is actively working on a fix to address them. Mitigation: Visit Tigo Energy's Help Center for more specific security recommendations. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-7768 | 9.3 Critical | Tigo Energy Cloud Connect Advanced Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This v… |
| CVE-2025-7769 | 8.7 High | Tigo Energy Cloud Connect Advanced Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allo… |
| CVE-2025-7770 | 8.7 High | Tigo Energy Cloud Connect Advanced Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable metho… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.