Riskcovery

CVE-2025-15573

Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

State
Published
Severity
9.4 Critical
Published
Feb 12, 2026
Updated
Feb 12, 2026
Reserved
Feb 9, 2026

Read the record on cve.org

Description

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.

Scores

CVSSScoreVectorSource
3.19.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LCISA-ADP

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
Pocket WiFi 3.0SolaX Power
  • <3.022.03Affected
Pocket WiFi+LANSolaX Power
  • <1.009.02Affected
Pocket WiFi+4GMSolaX Power
  • <1.005.05Affected
Pocket WiFi+LAN 2.0SolaX Power
  • <006.06Affected
Pocket WiFi 4.0SolaX Power
  • <003.03Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.