CVE-2025-9696: SunPower PVS6 Solar Monitoring Gateway Bluetooth Hardcoded-Key Takeover

CVE-2025-9696 is a hard-coded-credentials flaw (CWE-798) in the BluetoothLE interface of SunPower's PVS6, the monitoring and communications gateway that sits at the heart of a SunPower Equinox residential or commercial solar photovoltaic installation: because the device's BLE encryption parameters are hardcoded and its protocol details are publicly documented, an attacker within Bluetooth range can gain full access to the device's servicing interface without valid credentials, and NVD has not yet published its own Primary CVSS score — the Secondary rating shown on this page is CISA's.

CVE-2025-9696 (CWE-798, use of hard-coded credentials) affects SunPower's PVS6. NVD's description states: "The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices" (NVD).

The PVS6 is not an inverter or a utility meter itself; it is the datalogger-gateway appliance SunPower installs alongside an Equinox system's microinverters to meter production, monitor the home's solar and grid-tied electrical settings, and relay telemetry to SunPower's cloud monitoring platform over Wi-Fi, Ethernet or cellular — an embedded device that sits directly on the customer's electrical and network boundary.

NVD tracks CVE-2025-9696 with status "Deferred": it records only a CISA ICS-CERT-submitted score (source [email protected]) — CVSS v4.0 9.4 (critical), vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — typed Secondary, not NVD's own Primary rating, so this page does not present that figure as NVD-confirmed (NVD).

CISA's advisory ICSA-25-245-03, published 2025-09-02, separately calculated a CVSS v3.1 base score of 9.6 (vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) for the same flaw, places SunPower in the Energy sector with worldwide deployment, and credits researcher Dagan Henderson with reporting it (CISA ICS Advisory ICSA-25-245-03).

Both the v3.1 and v4.0 vectors score the attack vector as Adjacent/local network rather than remote over the open internet — exploitation requires an attacker to be within Bluetooth range of the physical device, not merely internet-connected. CISA's recommended mitigations for affected sites are the standard ICS baseline: minimize network exposure for control-system devices, ensure they are not reachable from the internet, isolate them behind firewalls from business networks, and use a VPN for any required remote access (CISA ICS Advisory ICSA-25-245-03).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0017 (6.7th percentile) as of 2026-11-07 — a high-severity flaw with confirmed vendor/CISA scoring but no reported in-the-wild exploitation (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, SunPower PVS6 installations running firmware at or below 2025.06 build 61839 should be treated as exposed to any attacker with Bluetooth-range physical proximity to the unit until the vendor publishes a firmware update closing the hardcoded-parameter BLE pairing path.

• SunPower PVS6's BluetoothLE interface uses hardcoded encryption parameters and publicly accessible protocol details; an attacker within Bluetooth range can gain full access to the device's servicing interface, enabling firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices. — NVD
• NVD status 'Deferred'; only a CISA ICS-CERT-submitted Secondary CVSS v4.0 base score of 9.4 is recorded, vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. — NVD
• CISA calculated CVSS v3.1 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); affects the Energy sector with worldwide deployment; reported by Dagan Henderson. Recommended mitigations: minimize network exposure, isolate behind firewalls, use VPN for remote access. — CISA ICS Advisory ICSA-25-245-03
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0017 (6.7th percentile) as of 2026-11-07. — FIRST EPSS