CVE-2019-19228

PoC ×3—

CVSS 3.1

9.8 critical

EPSS

2%p78

Published

Dec 4, 2019 (Dec 4, 2019)

Modified

Jun 17, 2026

Description

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.

Vendors: fronius
Products: datamanager box 2.0 firmware, eco 25.0-3-s firmware, eco 27.0-3-s firmware, galvo 1.5-1 firmware, galvo 1.5-1 208-240 firmware, galvo 2.0-1 firmware, galvo 2.0-1 208-240 firmware, galvo 2.5-1 firmware, galvo 2.5-1 208-240 firmware, galvo 3.0-1 firmware, galvo 3.1-1 firmware, galvo 3.1-1 208-240 firmware
Weakness: CWE-312
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news0 stories

No ingested article mentions this CVE yet.