CVE-2024-50696: Sungrowpower Winet-S Firmware

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server.

Affected products

• Sungrowpower Winet-S Firmware: up to and including 200.001.00.P025

Published 2025-02-26. Last modified 2026-06-17.