VORANT. Threat Intelligence Research Sign in Create a free account

Tigo Cloud Connect Advanced hard-coded credentials and RCE

elevated vulnerability energy

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Hard-coded credentials, command injection, and predictable session IDs in Tigo Cloud Connect Advanced v4.0.1 and prior enable remote unauthorized access and arbitrary code execution.

Tigo Energy Cloud Connect Advanced devices up to version 4.0.1 contain three critical vulnerabilities affecting solar energy infrastructure worldwide. CVE-2025-7768 (hard-coded credentials) allows unauthenticated remote administrative access with no authentication required. CVE-2025-7769 (command injection in /cgi-bin/mobile_api DEVICE_PING endpoint) enables arbitrary command execution when combined with default credentials, with public exploit code now available. CVE-2025-7770 (predictable PRNG-based session ID generation) allows attackers to forge valid session tokens using timestamp prediction. Successful exploitation grants attackers full device control, enabling them to disrupt solar energy production, modify system settings, interfere with safety mechanisms, and access sensitive data on connected inverter systems. CISA reports no confirmed active exploitation to date, but public exploits exist for the command injection vulnerability. The vendor is developing patches. Defenders should immediately isolate affected devices from internet exposure, place them behind firewalls, and segregate solar management networks from business networks.

Mentioned in this report

Vulnerabilities CVE-2025-7768CVE-2025-7769pocCVE-2025-7770

Detection guidance

Tigo Cloud Connect mobile_api DEVICE_PING Command Injection Attempt

ATT&CK T1190

Web request to /cgi-bin/mobile_api invoking DEVICE_PING with shell metacharacters in the query string, matching the CVE-2025-7769 command injection pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Tigo Cloud Connect mobile_api DEVICE_PING Command Injection Attempt
id: e1d8c5e1-f617-5655-947c-114a60c29f59
status: experimental
description: Detects HTTP requests to the /cgi-bin/mobile_api endpoint that reference
  DEVICE_PING and carry shell metacharacters (plain or URL-encoded) in the query string,
  consistent with CVE-2025-7769 command injection. Requires web or reverse-proxy logs
  that record the query string; if the payload is only in a POST body this will not
  fire.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: /cgi-bin/mobile_api
  selection_cmd:
    cs-uri-query|contains: DEVICE_PING
  selection_inject:
    cs-uri-query|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
    - '%3b'
    - '%7c'
    - '%60'
    - '%24%28'
    - '%26%26'
    - '%0a'
  condition: selection_path and selection_cmd and selection_inject
falsepositives:
- Vulnerability scanners probing the device with benign test payloads
- Authorized penetration tests against solar management devices
level: high
author: Vorant

Tigo Cloud Connect mobile_api Access From Non-Private Source

ATT&CK T1190

Requests to /cgi-bin/mobile_api from public IP addresses indicate an internet-exposed vulnerable device being reached, relevant to the hard-coded credential and command injection CVEs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Tigo Cloud Connect mobile_api Access From Non-Private Source
id: 67bd17f5-042f-59ac-80ad-62687206718c
status: experimental
description: Detects requests to the /cgi-bin/mobile_api endpoint of Tigo Cloud Connect
  Advanced devices originating from non-RFC1918 addresses. Exposure of this endpoint
  to the internet enables exploitation of the hard-coded credentials (CVE-2025-7768),
  command injection (CVE-2025-7769) and forged sessions (CVE-2025-7770). Tune by excluding
  the vendor cloud or known management ranges.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /cgi-bin/mobile_api
  filter_private:
    c-ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private
falsepositives:
- Legitimate remote monitoring by the installer or vendor mobile app over the internet
- Internet scanners hitting an exposed device with no exploit intent
level: medium
author: Vorant

Proxy Request Carrying DEVICE_PING Command Injection To mobile_api

ATT&CK T1190

Proxy or WAF logs showing a URI to /cgi-bin/mobile_api with DEVICE_PING and shell metacharacters, indicating attempted CVE-2025-7769 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Proxy Request Carrying DEVICE_PING Command Injection To mobile_api
id: 18cd4bd7-a02a-52f3-b209-a24f8553f362
status: experimental
description: Detects proxy or gateway log entries whose URI targets /cgi-bin/mobile_api
  with DEVICE_PING and command separators or substitution characters. Complements
  the webserver rule for environments where only a proxy sees the traffic.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
detection:
  selection_path:
    c-uri|contains:
    - /cgi-bin/mobile_api
  selection_cmd:
    c-uri|contains: DEVICE_PING
  selection_inject:
    c-uri|contains:
    - '%3b'
    - '%7c'
    - '%60'
    - '%24%28'
    - '%26%26'
    - '%0a'
    - ;
    - '|'
    - '`'
    - $(
  condition: selection_path and selection_cmd and selection_inject
falsepositives:
- Security testing tools replaying public exploit code in a lab
- Vulnerability scanners with injection checks
level: high
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs