{"id":"CVE-2024-8893","state":"PUBLISHED","title":"Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the in","description":"Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.1.","publishedAt":"2025-02-14T16:33:37.348Z","updatedAt":"2025-02-14T18:38:48.818Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"ENISA"},"assigner":"ENISA","products":["GoodWe Technologies Co., Ltd. GW1500‑XS"],"affected":[{"vendor":"GoodWe Technologies Co., Ltd.","product":"GW1500‑XS","defaultStatus":"unaffected","versions":[{"version":"1.1.2.1","status":"affected"}]}],"references":["https://os-s.net/publications/advisories/CVE-2024-8893.pdf"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8893.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8893","state":"PUBLISHED","datePublished":"2025-02-14T16:33:37.348Z","dateUpdated":"2025-02-14T18:38:48.818Z","assignerShortName":"ENISA","assignerOrgId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","dateReserved":"2024-09-16T13:09:21.400Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.1."}],"affected":[{"vendor":"GoodWe Technologies Co., Ltd.","product":"GW1500‑XS","defaultStatus":"unaffected","versions":[{"version":"1.1.2.1","status":"affected"}]}],"references":[{"url":"https://os-s.net/publications/advisories/CVE-2024-8893.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ENISA","orgId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","dateUpdated":"2025-02-14T16:33:37.348Z"},"credits":[{"lang":"en","type":"finder","value":"OpenSource Security GmbH (https://os‑s.net)"}],"impacts":[{"descriptions":[{"lang":"en","value":"Access to the web interface of the inverter via Wi‑Fi"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-14T18:38:41.339865Z","id":"CVE-2024-8893","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-14T18:38:48.818Z"}}]}}}