The solaredge-CSRF-Hijack vulnerability allows attackers to perform Cross-Site Request Forgery (CSRF) by exploiting an unvalidated session parameter generation endpoint. Additionally, an Out-of-Band (OOB) injection vulnerability exists via the `X-Forwarded-For` and `Referer` headers, enabling attackers to force the SolarEdge infrastructure to send requests to external domains, leading to session compromise and potential unauthorized control over photovoltaic systems.
| Vendor | Product | Versions |
|---|---|---|
| solaredge technologies | solaredge monitoring | — |
