CVE-2025-7770
High
Description
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.
SeverityHigh
CVSS8.7
Exploit probability—
ProductCloud Connect Advanced
PublishedAug 6, 2025
First seenAug 6, 2025
Weakness typeCWE-337CWE-337
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Tigo Energy Cloud Connect Advanced | v ≤ 4.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.