CVE-2025-7769— Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced
Quick assessment
Affected
Tigo Energy Cloud Connect Advanced
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tigo Energy Cloud Connect Advanced是美国Tigo Energy公司的一款紧凑型数据记录器。 Tigo Energy Cloud Connect Advanced存在命令注入漏洞，该漏洞源于命令注入，可能导致远程代码执行。
Public Exploits 1
ExploitDB · 1
EDB-52404 [remote]
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-7769
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced
Source: CVE Program / CVE List V5
Vulnerability Description
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Tigo Energy Cloud Connect Advanced 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tigo Energy Cloud Connect Advanced是美国Tigo Energy公司的一款紧凑型数据记录器。 Tigo Energy Cloud Connect Advanced存在命令注入漏洞，该漏洞源于命令注入，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Tigo Energy | Cloud Connect Advanced | 0 ~ 4.0.1 | - |
|
II. Public POCs for CVE-2025-7769
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | PoC to inject a command via the DEVICE_PING endpoint | https://github.com/byteReaper77/CVE-2025-7769 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-7769
请登录查看更多情报信息。
Same Patch Batch · Tigo Energy · 2025-08-06 · 3 CVEs total
| CVE-2025-7768 | Use of Hard-coded Credentials in Tigo Energy Cloud Connect Advanced | |
| CVE-2025-7770 | Predictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect Adv |
IV. Related Vulnerabilities
V. Comments for CVE-2025-7769
No comments yet