CVE-2025-15575 - CVE House
Back to Database
Status published Unknown CVE-2025-15575

Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models

Vulnerability Description

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15575

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Stefan Viehböck, SEC Consult Vulnerability Lab

References

More from SolaX Power

View All →
CVE-2025-36759
Sensitive Information Disclosure in SolaX Cloud
High 8.7
CVE-2025-36758
Bypass of bruteforce protection in SolaX Cloud
Medium 6.3
CVE-2025-36757
Bypass of administrator login screen in SolaX Cloud
Medium 6.3
CVE-2025-36756
Device Takeover vulnerability in SolaX Cloud
Medium 5.8
CVE-2025-15574
Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection
Unknown 0

Affected Vendor

SolaX Power

View all reports →

Affected Software

Pocket WiFi 3.0, Pocket WiFi+LAN, Pocket WiFi+4GM, Pocket WiFi+LAN 2.0, Pocket WiFi 4.0
Vulnerable Versions:
<3.022.03, <1.009.02, <1.005.05, <006.06, <003.03

Timeline

Official Publish: February 12th, 2026
Last Modified: February 12th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-494

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.