# SunPower PVS6 hardcoded Bluetooth credentials enable full device compromise

Published: 2025-09-02 · Severity: routine · Sectors: energy
Canonical: https://vorant.io/reports/6c44e091-f5e1-51ea-be15-b58e053db848/sunpower-pvs6-hardcoded-bluetooth-credentials-enable-full-device-compromise

> SunPower PVS6 solar controller contains hardcoded Bluetooth credentials allowing local attackers to gain full device access and manipulate power generation.

SunPower PVS6 power inverter systems contain a critical vulnerability (CVE-2025-9696) in the BluetoothLE interface stemming from hardcoded encryption parameters and publicly documented protocol details. An attacker within Bluetooth range can exploit this to gain full administrative access to the device's servicing interface without authentication. Successful exploitation permits firmware replacement, power production disabling, grid settings modification, SSH tunnel creation, firewall alteration, and manipulation of connected devices.

The vulnerability affects PVS6 versions 2025.06 build 61839 and all prior versions. CVSS v4 score is 9.4 (adjacent network attack, low complexity). The attack is not remotely exploitable—it requires physical or nearby wireless proximity. CISA reports no active public exploitation at the time of publication. SunPower has not responded to CISA coordination attempts, leaving no vendor patch available.

Defenders should isolate PVS6 devices on segmented networks, disable unnecessary remote access, restrict Bluetooth range where operationally feasible, and monitor for unauthorized Bluetooth connections or administrative activity on affected systems. Organizations should contact SunPower directly for guidance pending an official security update.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9696

## Detection guidance (public sample)

### SSH Port Forwarding Tunnel Created via Non-Interactive ssh Client on Linux

ATT&CK: T1572

Detects ssh run with -N plus a -R, -L or -D forward, the pattern for a persistent tunnel on an embedded or IoT Linux host. Relevant to the PVS6 post-exploitation capability of SSH tunnel creation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SSH Port Forwarding Tunnel Created via Non-Interactive ssh Client on Linux
description: Detects ssh launched with -N (no remote command) together with a remote,
  local or dynamic forward (-R/-L/-D). This is how an attacker with servicing access
  to an embedded Linux device such as a solar inverter gateway would typically build
  a persistent tunnel. Tune by excluding known admin jump hosts.
tags:
- attack.command-and-control
- attack.t1572
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /ssh
  selection_noshell:
    CommandLine|contains: ' -N'
  selection_forward:
    CommandLine|contains:
    - ' -R '
    - ' -L '
    - ' -D '
  condition: selection_img and selection_noshell and selection_forward
falsepositives:
- Administrators opening sanctioned port-forwards from a bastion or maintenance host
- Automated backup or monitoring jobs that use autossh-style tunnels
level: medium
id: 8005e487-97f0-5762-b969-203d38d66182
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
```

### Linux Host Firewall Disabled or Default Policy Set to Accept

ATT&CK: T1686

Detects flushing of iptables rules, setting the default INPUT or FORWARD policy to ACCEPT, or disabling ufw or firewalld. Relevant to the PVS6 post-exploitation capability of firewall alteration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Host Firewall Disabled or Default Policy Set to Accept
description: Detects commands that flush iptables rules, set default INPUT/FORWARD
  policy to ACCEPT, or stop ufw/firewalld. An attacker with administrative servicing
  access to an embedded Linux device may alter the firewall to expose services or
  allow tunnels.
tags:
- attack.defense-impairment
- attack.t1686
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_iptables_flush:
    Image|endswith:
    - /iptables
    - /ip6tables
    - /nft
    CommandLine|contains:
    - ' -F'
    - ' --flush'
    - flush ruleset
  selection_iptables_policy:
    Image|endswith:
    - /iptables
    - /ip6tables
    CommandLine|contains:
    - -P INPUT ACCEPT
    - -P FORWARD ACCEPT
  selection_ufw:
    Image|endswith: /ufw
    CommandLine|contains: disable
  selection_firewalld:
    Image|endswith: /systemctl
    CommandLine|contains|all:
    - stop
    - firewalld
  condition: 1 of selection_*
falsepositives:
- Administrators resetting firewall rules during troubleshooting or provisioning
- Configuration management or container runtimes that flush and reload iptables
level: medium
id: 73907fe9-991a-55fa-be38-0ed0d15e2667
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6c44e091-f5e1-51ea-be15-b58e053db848/sunpower-pvs6-hardcoded-bluetooth-credentials-enable-full-device-compromise.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup