Riskcovery

CVE-2025-15575

Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models

State
Published
Severity
5.3 Medium
Published
Feb 12, 2026
Updated
Feb 12, 2026
Reserved
Feb 9, 2026

Read the record on cve.org

Description

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCISA-ADP

Weaknesses

  • CWE-494 Download of Code Without Integrity Check

Affected Products

ProductVersions
Pocket WiFi 3.0SolaX Power
  • <3.022.03Affected
Pocket WiFi+LANSolaX Power
  • <1.009.02Affected
Pocket WiFi+4GMSolaX Power
  • <1.005.05Affected
Pocket WiFi+LAN 2.0SolaX Power
  • <006.06Affected
Pocket WiFi 4.0SolaX Power
  • <003.03Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.