noindex and left out of the sitemap until more data is confirmed.CVE-2025-7768 is a hard-coded-credentials flaw (CWE-798) in Tigo Energy's Cloud Connect Advanced (CCA), the on-site gateway appliance that bridges a rooftop solar array's Tigo TS4 module-level power electronics to Tigo's cloud monitoring platform: because the device ships with hard-coded credentials, an unauthorized user can gain administrative access, escalate privileges, and take full control of the device, and NVD has not yet published its own Primary CVSS score — the Secondary rating shown on this page is CISA's.
Vulnerability summary
N/A
Not yet scored
0.6%
EPSS score (FIRST)
No
CISA KEV catalog
2025-08-06
Published
Vulnerability ID: CVE-2025-7768 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Tigo Energy Cloud Connect Advanced (CCA), the on-site data-logger/communications gateway that connects Tigo TS4 module-level power electronics in residential and commercial solar PV installations to Tigo's cloud monitoring platform | — | Cloud Connect Advanced versions 4.0.1 and prior, per CISA's advisory |
What does this mean for affected devices?
CVE-2025-7768 (CWE-798, use of hard-coded credentials) affects Tigo Energy's Cloud Connect Advanced. NVD's description states: "Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms" (NVD).
The CCA is a physical data-logger and communications gateway: it sits near a building's electrical service panel, talks to Tigo Access Points mounted on the solar array, collects module-level voltage, current, power and temperature telemetry from up to 900 TS4 units, and relays that data to Tigo's Energy Intelligence cloud platform over Ethernet, Wi-Fi or cellular — the same class of grid-facing monitoring-gateway device as the inverters and meters it instruments.
NVD tracks CVE-2025-7768 with status "Deferred": it records only a CISA ICS-CERT-submitted score (source [email protected]) — CVSS v4.0 9.3 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — typed Secondary, not NVD's own Primary rating, so this page does not present that figure as NVD-confirmed (NVD).
CISA's advisory ICSA-25-217-02 (published 2025-08-05, updated 2025-08-19) separately calculated a CVSS v3.1 base score of 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), lists Tigo Energy as the vendor with the Energy sector affected worldwide, and credits Anthony Rose and Jacob Krasnov of BC Security along with Peter Kariuki of Ovanova for reporting this and two companion flaws disclosed in the same advisory: CVE-2025-7769, a command-injection vulnerability in the CCA's /cgi-bin/mobile_api DEVICE_PING endpoint, and CVE-2025-7770, predictable, timestamp-based session-ID generation that lets an attacker forge valid sessions (CISA ICS Advisory ICSA-25-217-02).
Because the flaw requires no credentials, no user interaction and is reachable over the network, CISA's recommended mitigations for affected sites are the standard ICS baseline: isolate the CCA from direct internet access and business networks, deploy it behind a firewall, use a VPN for any required remote access, and monitor for suspected malicious activity (CISA ICS Advisory ICSA-25-217-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0063 (50.5th percentile) as of 2026-11-07 — a critical-severity flaw with confirmed CISA scoring but no reported in-the-wild exploitation (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis. In the meantime, any Cloud Connect Advanced unit at version 4.0.1 or earlier should be treated as exposed to full administrative takeover by any network-reachable attacker who knows or guesses its hard-coded credentials, and isolated from untrusted networks until a credential-rotation fix from Tigo Energy is applied.
Evidence
- Tigo Energy's Cloud Connect Advanced (CCA) contains hard-coded credentials allowing unauthorized administrative access, privilege escalation, and full device control, potentially modifying system settings, disrupting solar energy production, and interfering with safety mechanisms. — NVD
- NVD status 'Deferred'; only a CISA ICS-CERT-submitted Secondary CVSS v4.0 base score of 9.3 is recorded, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. — NVD
- CISA calculated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); affects CCA versions 4.0.1 and prior in the Energy sector worldwide; reported by Anthony Rose and Jacob Krasnov (BC Security) and Peter Kariuki (Ovanova); companion flaws CVE-2025-7769 (command injection via /cgi-bin/mobile_api DEVICE_PING) and CVE-2025-7770 (predictable session IDs) disclosed in the same advisory. — CISA ICS Advisory ICSA-25-217-02
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0063 (50.5th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
