CVE-2025-15574: SolaX Cloud MQTT Auth Bypass Vulnerability

CVE-2025-15574 Overview

CVE-2025-15574 is an insecure random number generation vulnerability (CWE-330) affecting the SolaX Cloud MQTT server authentication mechanism. When connecting to the Solax Cloud MQTT server, the username is the "registration number," which is a 10-character string printed on the SolaX Power Pocket device and encoded in the QR code on the device. The password is derived from this registration number using a proprietary XOR/transposition algorithm. Attackers with knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle or inverters, potentially gaining unauthorized access to solar energy infrastructure.

Critical Impact

Attackers can impersonate legitimate SolaX devices and connect to the MQTT server, potentially manipulating solar inverter communications and compromising IoT energy infrastructure.

Affected Products

• SolaX Power Pocket WiFi Dongle
• SolaX Cloud MQTT Server
• SolaX Inverter Systems with WiFi Connectivity

Discovery Timeline

• 2026-02-12 - CVE CVE-2025-15574 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-15574

Vulnerability Analysis

This vulnerability stems from a fundamentally weak authentication design in the SolaX Cloud MQTT infrastructure. The system relies on device registration numbers as usernames—identifiers that are physically printed on devices and encoded in easily scannable QR codes. More critically, the password derivation mechanism uses a deterministic XOR/transposition algorithm based solely on the registration number, meaning that possession of the registration number is sufficient to compute valid credentials.

The attack surface is network-accessible with no required privileges or user interaction. The use of predictable credential generation allows attackers to authenticate as legitimate devices, potentially enabling unauthorized monitoring of energy production data, injection of false telemetry, or disruption of device-to-cloud communications. This represents a significant IoT security concern for renewable energy infrastructure.

Root Cause

The root cause is the use of insufficiently random values for authentication (CWE-330). The credential generation scheme fails to incorporate any secret or unpredictable element—the registration number alone determines both the username and password. This violates fundamental cryptographic principles where authentication secrets should be derived from high-entropy sources that cannot be determined from publicly observable device identifiers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who obtains a device's registration number—through physical access to a device, photographing QR codes, social engineering, or enumeration attempts—can derive valid MQTT credentials and connect to the SolaX Cloud server. Once connected, the attacker can:

1. Impersonate legitimate devices and inject false data
2. Monitor communications intended for the actual device
3. Potentially issue commands to inverters
4. Disrupt normal device-to-cloud synchronization

The deterministic nature of the password algorithm means that the vulnerability affects all devices using this authentication scheme, not just individual compromised units.

Detection Methods for CVE-2025-15574

Indicators of Compromise

• Multiple MQTT connection attempts from unexpected IP addresses using valid device registration numbers
• Simultaneous connections from geographically disparate locations using the same device credentials
• Anomalous connection patterns or unusual timing of device check-ins
• Device telemetry data inconsistent with expected solar production patterns

Detection Strategies

• Monitor MQTT broker logs for authentication attempts using the same registration number from multiple source IPs
• Implement geolocation-based anomaly detection for device connections
• Deploy network traffic analysis to identify connections from untrusted networks to the MQTT infrastructure
• Establish baseline device behavior patterns and alert on deviations

Monitoring Recommendations

• Enable comprehensive logging on MQTT broker infrastructure with timestamp and source IP tracking
• Implement rate limiting on authentication attempts per registration number
• Deploy SIEM rules to correlate device connection events across geographic regions
• Monitor for brute-force enumeration attempts against registration number patterns

How to Mitigate CVE-2025-15574

Immediate Actions Required

• Review and audit current device authentication logs for suspicious activity
• Implement additional authentication factors beyond registration number-derived credentials
• Consider network segmentation to limit exposure of MQTT infrastructure
• Deploy allowlisting of known legitimate device IP ranges where feasible
• Contact SolaX support for guidance on updated firmware or authentication mechanisms

Patch Information

At the time of publication, no vendor patch information is available in the NVD. Organizations should monitor the SEC Consult Security Report for updates and consult with SolaX directly for remediation guidance. Device owners should ensure firmware is updated to the latest available version and implement network-level controls as compensating measures.

Workarounds

• Implement network-level access controls to restrict MQTT server access to known trusted IP ranges
• Deploy VPN or private network connections for device-to-cloud communications where infrastructure permits
• Physical security measures to prevent unauthorized access to device labels and QR codes
• Monitor for and revoke credentials of potentially compromised registration numbers
• Consider disabling cloud connectivity for critical installations until a vendor fix is available