SunPower PVS6 hardcoded Bluetooth credentials enable full device compromise
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
SunPower PVS6 solar controller contains hardcoded Bluetooth credentials allowing local attackers to gain full device access and manipulate power generation.
SunPower PVS6 power inverter systems contain a critical vulnerability (CVE-2025-9696) in the BluetoothLE interface stemming from hardcoded encryption parameters and publicly documented protocol details. An attacker within Bluetooth range can exploit this to gain full administrative access to the device's servicing interface without authentication. Successful exploitation permits firmware replacement, power production disabling, grid settings modification, SSH tunnel creation, firewall alteration, and manipulation of connected devices.
The vulnerability affects PVS6 versions 2025.06 build 61839 and all prior versions. CVSS v4 score is 9.4 (adjacent network attack, low complexity). The attack is not remotely exploitable—it requires physical or nearby wireless proximity. CISA reports no active public exploitation at the time of publication. SunPower has not responded to CISA coordination attempts, leaving no vendor patch available.
Defenders should isolate PVS6 devices on segmented networks, disable unnecessary remote access, restrict Bluetooth range where operationally feasible, and monitor for unauthorized Bluetooth connections or administrative activity on affected systems. Organizations should contact SunPower directly for guidance pending an official security update.
Mentioned in this report
Detection guidance
SSH Port Forwarding Tunnel Created via Non-Interactive ssh Client on Linux
Detects ssh run with -N plus a -R, -L or -D forward, the pattern for a persistent tunnel on an embedded or IoT Linux host. Relevant to the PVS6 post-exploitation capability of SSH tunnel creation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Port Forwarding Tunnel Created via Non-Interactive ssh Client on Linux
description: Detects ssh launched with -N (no remote command) together with a remote,
local or dynamic forward (-R/-L/-D). This is how an attacker with servicing access
to an embedded Linux device such as a solar inverter gateway would typically build
a persistent tunnel. Tune by excluding known admin jump hosts.
tags:
- attack.command-and-control
- attack.t1572
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /ssh
selection_noshell:
CommandLine|contains: ' -N'
selection_forward:
CommandLine|contains:
- ' -R '
- ' -L '
- ' -D '
condition: selection_img and selection_noshell and selection_forward
falsepositives:
- Administrators opening sanctioned port-forwards from a bastion or maintenance host
- Automated backup or monitoring jobs that use autossh-style tunnels
level: medium
id: 8005e487-97f0-5762-b969-203d38d66182
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
Linux Host Firewall Disabled or Default Policy Set to Accept
Detects flushing of iptables rules, setting the default INPUT or FORWARD policy to ACCEPT, or disabling ufw or firewalld. Relevant to the PVS6 post-exploitation capability of firewall alteration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Host Firewall Disabled or Default Policy Set to Accept
description: Detects commands that flush iptables rules, set default INPUT/FORWARD
policy to ACCEPT, or stop ufw/firewalld. An attacker with administrative servicing
access to an embedded Linux device may alter the firewall to expose services or
allow tunnels.
tags:
- attack.defense-impairment
- attack.t1686
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_iptables_flush:
Image|endswith:
- /iptables
- /ip6tables
- /nft
CommandLine|contains:
- ' -F'
- ' --flush'
- flush ruleset
selection_iptables_policy:
Image|endswith:
- /iptables
- /ip6tables
CommandLine|contains:
- -P INPUT ACCEPT
- -P FORWARD ACCEPT
selection_ufw:
Image|endswith: /ufw
CommandLine|contains: disable
selection_firewalld:
Image|endswith: /systemctl
CommandLine|contains|all:
- stop
- firewalld
condition: 1 of selection_*
falsepositives:
- Administrators resetting firewall rules during troubleshooting or provisioning
- Configuration management or container runtimes that flush and reload iptables
level: medium
id: 73907fe9-991a-55fa-be38-0ed0d15e2667
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs