CVE-2023-0808: Deye/revolt/Bosswerk Micro-Inverter Hard-Coded Wi-Fi Access-Point Password

CVE-2023-0808 is a hard-coded Wi-Fi access-point password (CWE-798) in balcony-solar micro-inverters manufactured by Chinese vendor Deye and resold in Germany under the brand names revolt (by retailer Pearl) and Bosswerk (by retailer Greenakku): the inverter's setup access point uses the fixed key 12345678, which the firmware never actually disables or lets the owner change even after setup, so anyone within Wi-Fi range can connect and, via the device's AT-command interface, recover the owner's home Wi-Fi password — NVD's own analysis rates the flaw 6.8 (medium) on CVSS v3.1.

CVE-2023-0808 (CWE-798, Use of Hard-coded Credentials; also tracked under CWE-259, Use of a Hard-coded Password) affects micro-inverters built by Chinese manufacturer Deye and used in "balcony power plant" (Balkonkraftwerk) solar kits. NVD's description states: "A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471 ... The manipulation with the input 12345678 leads to use of hard-coded password" (NVD).

German technology outlet heise online, which first reported the issue, found that the same physical inverter hardware is sold under at least three brand names: retailer Pearl sells it as "revolt," online shop Greenakku sells it as "Bosswerk," and discount retailer Netto bundled it into its own balcony-solar kit under the manufacturer's own "Deye" name. All three connect over Wi-Fi and report generation data to the cloud platform of a company called Solarman. During setup, the inverter opens its own Wi-Fi access point, secured with the fixed key 12345678, so the owner can enter their home network's credentials through the inverter's web interface; the interface then shows a "Save" button meant to disable that setup access point. heise's testing found the button has no effect: the access point stays open indefinitely, and the key cannot be changed. Because the access point's SSID pattern is easy to recognize and the default key is public knowledge, heise reported that a nearby attacker can connect and, via an AT-command interface the device exposes, recover the home Wi-Fi credentials the owner entered, and — according to reports from readers heise cited but did not independently verify — potentially force the inverter out of grid-synchronized operation, which heise noted could cause serious damage if the inverter is switched over while still connected to the grid (heise online, "Balkonkraftwerke: Sicherheitslücke in Mikrowechselrichtern von Deye").

NVD's own Primary analysis rates the flaw 6.8 (medium) on CVSS v3.1, vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (physical/radio-range attack vector); a Secondary score submitted independently by VulDB rates the same report lower, 3.9 on CVSS v3.1 (NVD).

As of heise's reporting (3 February 2023), there was no public firmware download: the only documented fix path was to email Deye's support address ([email protected]) in English with the device's serial number and request the updated firmware (MW3_16U_5406_1.53), which several readers reported receiving after a few days, though heise's own test unit had not received it weeks after asking. heise also found that retailers forwarded security complaints to customers with workaround advice (isolating the inverter on a guest Wi-Fi network, restricting access by MAC address) rather than a fix.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0023 (13.9th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

Owners of Deye, revolt or Bosswerk balcony-solar micro-inverters should request the updated firmware directly from Deye support and, in the meantime, should not assume the inverter's setup Wi-Fi access point ever closes on its own.

• A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471; manipulation with the input 12345678 leads to use of hard-coded password (CWE-798/CWE-259). — NVD
• The same inverter hardware is sold as revolt (Pearl), Bosswerk (Greenakku) and Deye (Netto); the Wi-Fi setup access point's fixed key 12345678 cannot be disabled or changed despite the web UI's 'Save' button; an attacker in range can recover the owner's home Wi-Fi password via the device's AT-command interface. No public firmware download existed as of 3 Feb 2023; the fix (firmware MW3_16U_5406_1.53) was obtainable only by emailing Deye support with the device serial number. — heise online
• NVD's own Primary CVSS v3.1 score is 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); VulDB's independently submitted Secondary CVSS v3.1 score is 3.9. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0023 (13.9th percentile) as of 2026-11-08. — FIRST EPSS