Security Advisory

CVE-2024-8893: GoodWe GW1500-XS Inverter Wi-Fi BOX Hard-Coded Credentials

Last updated:
  • CVE-2024-8893
NVD assessment pendingNVD has published no CVSS score or CPE applicability statement of its own for this vulnerability, and it is not in the CISA KEV catalog. This summary rests on the sources cited on this page.

CVE-2024-8893 is a hard-coded credentials vulnerability (CWE-798) in the Wi-Fi BOX communication module of GoodWe's GW1500-XS solar inverter: anyone within physical or radio proximity of the device can use the built-in, undocumented credentials to fully access the inverter's web interface over Wi-Fi and change its network configuration or restart it, and the discovering researcher rates the flaw 7.3 (high) on CVSS v3.0; NVD has not yet published its own Primary CVSS score.

Vulnerability summary

N/A

Score pending

0.3%

EPSS score (FIRST)

No

CISA KEV catalog

2025-02-14

Published

Vulnerability ID: CVE-2024-8893 · Source: NVD

Affected components

ComponentCPEVersion range
GoodWe GW1500-XS solar inverter (Wi-Fi BOX communication module web interface)—GW1500-XS, firmware version V1.1.2.1, per OpenSource Security GmbH advisory CVE-2024-8893

What does this mean for affected devices?

CVE-2024-8893 (CWE-798, Use of Hard-coded Credentials) affects the Wi-Fi BOX module used for the GW1500-XS inverter from GoodWe Technologies Co., Ltd. NVD's description states: "Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500-XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi-Fi. This issue affects GW1500-XS: 1.1.2.1" (NVD).

The vulnerability was found and published by OpenSource Security GmbH, a German security research firm. Its advisory, dated 4 February 2025, describes the flaw in full: "Use of Hard-coded Credentials in the Wi-Fi BOX used for the inverter GW1500-XS in GoodWe Technologies Co., Ltd. in Version V1.1.2.1 allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi-Fi. An adversary may use this web interface to change the inverter's network configuration or restart the device." The advisory rates the issue 7.3 (high) on CVSS v3.0, vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (OpenSource Security GmbH advisory, CVE-2024-8893).

NVD tracks CVE-2024-8893 with status "Deferred" as of this review: it records only OpenSource Security GmbH's own submitted score (source identifier a6d3dc9e-0591-4a13-bce7-0f5b31ff6158) — CVSS v3.1 7.3 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00295 (22.3th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of GoodWe GW1500-XS inverters should treat the Wi-Fi BOX's built-in access as untrusted: restrict physical and Wi-Fi proximity to the device where possible, and apply any firmware update GoodWe makes available for the affected version.

How to fix this class of issueThis advisory's weakness class is Hard-coded credentials. Our practical guide covers how to detect, fix, verify and disclose it: How to fix hard-coded credentials in embedded firmware.

Evidence

  • Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500-XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi-Fi; affects GW1500-XS version 1.1.2.1. — NVD
  • Found and published by OpenSource Security GmbH, dated 4 February 2025; an adversary may use the web interface to change the inverter's network configuration or restart the device; scored 7.3 (high) on CVSS v3.0, vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. — OpenSource Security GmbH advisory
  • NVD status 'Deferred'; records only OpenSource Security GmbH's own Secondary CVSS v3.1 score of 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; no NVD-published Primary score as of this review. — NVD
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00295 (22.3th percentile) as of 2026-11-08. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2025-36752: Growatt ShineLan-X Communication Dongle Undocumented Backdoor Account — CVSS 9.8, Critical severityCVE-2025-36752: the Growatt ShineLan-X communication dongle used on Growatt solar inverters ships with an undocumented backup account and undocumented credentials that give an attacker significant access to the device, including the Setting Center. NVD's own analysis scores it 9.8 (CVSS v3.1, critical).CVE-2025-52601: Hanwha Vision IP Camera Firmware Hardcoded Encryption Key — CVSS 7.8, High severityCVE-2025-52601: a hardcoded symmetric encryption key baked into firmware across 128+ Hanwha Vision network camera and multi-sensor models lets anyone who extracts it decrypt sensitive stored information such as credentials. NVD Primary CVSS 7.8; discovered by Nozomi Networks Labs; sourced to NVD and Hanwha Vision's own vulnerability report.CVE-2025-7768: Tigo Energy Cloud Connect Advanced Hard-Coded Credentials Full Device TakeoverCVE-2025-7768: Tigo Energy's Cloud Connect Advanced (CCA), the on-site gateway that bridges rooftop solar module-level power electronics to Tigo's cloud monitoring platform, contains hard-coded credentials that let an unauthorized user gain administrative access, escalate privileges, and take full control of the device. NVD records only a CISA-submitted Secondary CVSS v4.0 score of 9.3; sourced to NVD and CISA.

Sources

  1. NVD
  2. OpenSource Security GmbH advisory CVE-2024-8893
  3. CISA KEV
  4. FIRST EPSS

Frequently asked questions

What is CVE-2024-8893?

CVE-2024-8893 is a hard-coded credentials vulnerability (CWE-798) in the Wi-Fi BOX communication module of GoodWe's GW1500-XS solar inverter: anyone within physical or radio proximity of the device can use the built-in, undocumented credentials to fully access the inverter's web interface over Wi-Fi and change its network configuration or restart it, and the discovering researcher rates the flaw 7.3 (high) on CVSS v3.0; NVD has not yet published its own Primary CVSS score.

How severe is CVE-2024-8893?

CVE-2024-8893 has not yet been assigned a CVSS score, so it is tracked here as not yet scored rather than assumed low or high risk.

Is CVE-2024-8893 being actively exploited?

CVE-2024-8893 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.29%.

What is affected by CVE-2024-8893?

CVE-2024-8893 affects GoodWe GW1500-XS solar inverter (Wi-Fi BOX communication module web interface).

Where does this CVE-2024-8893 information come from?

This advisory is based on NVD, OpenSource Security GmbH advisory CVE-2024-8893, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.