CVE-2025-15573: Solax Power Pocket wifi+4gm

Critical severity, CVSS 9.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.

Affected products

• Solax Power Pocket wifi+4gm: before 1.005.05 (fixed in 1.005.05)
• Solax Power Pocket Wifi+lan: before 1.009.02 (fixed in 1.009.02)
• Solax Power Pocket Wifi+lan 2.0: before 006.06 (fixed in 006.06)
• Solax Power Pocket Wifi 3.0: before 3.022.03 (fixed in 3.022.03)
• Solax Power Pocket Wifi 4.0: before 003.03 (fixed in 003.03)

Published 2026-02-12. Last modified 2026-06-17.