CVE-2019-19228: Fronius Datamanager Box 2.0 Firmware

Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.

Affected products

  • Fronius Datamanager Box 2.0 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Eco 25.0-3-S Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Eco 27.0-3-S Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 1.5-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 1.5-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 2.0-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 2.0-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 2.5-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 2.5-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 3.0-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 3.1-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Galvo 3.1-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 10.0-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 11.4-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 12.5-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 15.0-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 3.0-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 3.5-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 3.6-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 3.8-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 4.0-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 4.6-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 5.0-1 208-240 Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 5.0-1 Aus Firmware: before 3.14.1 (fixed in 3.14.1)
  • Fronius Primo 5.0-1 Firmware: before 3.14.1 (fixed in 3.14.1)
  • and 41 more

Published 2019-12-04. Last modified 2026-06-17.