SunPower PVS6 BluetoothLE Interface hard-coded credentials

Summaryinfo

A vulnerability categorized as critical has been discovered in SunPower PVS6. The affected element is an unknown function of the component BluetoothLE Interface. The manipulation results in hard-coded credentials. This vulnerability was named CVE-2025-9696. The attack needs to be approached within the local network. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in SunPower PVS6 (affected version unknown). Affected is an unknown functionality of the component BluetoothLE Interface. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices.

The weakness was presented by Dagan Henderson as icsa-25-245-03. The advisory is available at cisa.gov. This vulnerability is traded as CVE-2025-9696 since 08/29/2025. The exploitability is told to be easy. The attack can only be done within the local network. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/02/2025). This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-26418). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• SunPower

Name

• PVS6

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion