# Tigo Cloud Connect Advanced hard-coded credentials and RCE

Published: 2025-08-19 · Severity: elevated · Sectors: energy
Canonical: https://vorant.io/reports/e26d58de-a0ff-5a3f-b161-5439fb07a67e/tigo-cloud-connect-advanced-hard-coded-credentials-and-rce

> Hard-coded credentials, command injection, and predictable session IDs in Tigo Cloud Connect Advanced v4.0.1 and prior enable remote unauthorized access and arbitrary code execution.

Tigo Energy Cloud Connect Advanced devices up to version 4.0.1 contain three critical vulnerabilities affecting solar energy infrastructure worldwide. CVE-2025-7768 (hard-coded credentials) allows unauthenticated remote administrative access with no authentication required. CVE-2025-7769 (command injection in /cgi-bin/mobile_api DEVICE_PING endpoint) enables arbitrary command execution when combined with default credentials, with public exploit code now available. CVE-2025-7770 (predictable PRNG-based session ID generation) allows attackers to forge valid session tokens using timestamp prediction. Successful exploitation grants attackers full device control, enabling them to disrupt solar energy production, modify system settings, interfere with safety mechanisms, and access sensitive data on connected inverter systems. CISA reports no confirmed active exploitation to date, but public exploits exist for the command injection vulnerability. The vendor is developing patches. Defenders should immediately isolate affected devices from internet exposure, place them behind firewalls, and segregate solar management networks from business networks.

## Mentioned in this report

- Vulnerabilities: CVE-2025-7768, CVE-2025-7769 (poc), CVE-2025-7770

## Detection guidance (public sample)

### Tigo Cloud Connect mobile_api DEVICE_PING Command Injection Attempt

ATT&CK: T1190

Web request to /cgi-bin/mobile_api invoking DEVICE_PING with shell metacharacters in the query string, matching the CVE-2025-7769 command injection pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Tigo Cloud Connect mobile_api DEVICE_PING Command Injection Attempt
id: e1d8c5e1-f617-5655-947c-114a60c29f59
status: experimental
description: Detects HTTP requests to the /cgi-bin/mobile_api endpoint that reference
  DEVICE_PING and carry shell metacharacters (plain or URL-encoded) in the query string,
  consistent with CVE-2025-7769 command injection. Requires web or reverse-proxy logs
  that record the query string; if the payload is only in a POST body this will not
  fire.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: /cgi-bin/mobile_api
  selection_cmd:
    cs-uri-query|contains: DEVICE_PING
  selection_inject:
    cs-uri-query|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
    - '%3b'
    - '%7c'
    - '%60'
    - '%24%28'
    - '%26%26'
    - '%0a'
  condition: selection_path and selection_cmd and selection_inject
falsepositives:
- Vulnerability scanners probing the device with benign test payloads
- Authorized penetration tests against solar management devices
level: high
author: Vorant
```

### Tigo Cloud Connect mobile_api Access From Non-Private Source

ATT&CK: T1190

Requests to /cgi-bin/mobile_api from public IP addresses indicate an internet-exposed vulnerable device being reached, relevant to the hard-coded credential and command injection CVEs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Tigo Cloud Connect mobile_api Access From Non-Private Source
id: 67bd17f5-042f-59ac-80ad-62687206718c
status: experimental
description: Detects requests to the /cgi-bin/mobile_api endpoint of Tigo Cloud Connect
  Advanced devices originating from non-RFC1918 addresses. Exposure of this endpoint
  to the internet enables exploitation of the hard-coded credentials (CVE-2025-7768),
  command injection (CVE-2025-7769) and forged sessions (CVE-2025-7770). Tune by excluding
  the vendor cloud or known management ranges.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /cgi-bin/mobile_api
  filter_private:
    c-ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private
falsepositives:
- Legitimate remote monitoring by the installer or vendor mobile app over the internet
- Internet scanners hitting an exposed device with no exploit intent
level: medium
author: Vorant
```

### Proxy Request Carrying DEVICE_PING Command Injection To mobile_api

ATT&CK: T1190

Proxy or WAF logs showing a URI to /cgi-bin/mobile_api with DEVICE_PING and shell metacharacters, indicating attempted CVE-2025-7769 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Proxy Request Carrying DEVICE_PING Command Injection To mobile_api
id: 18cd4bd7-a02a-52f3-b209-a24f8553f362
status: experimental
description: Detects proxy or gateway log entries whose URI targets /cgi-bin/mobile_api
  with DEVICE_PING and command separators or substitution characters. Complements
  the webserver rule for environments where only a proxy sees the traffic.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
detection:
  selection_path:
    c-uri|contains:
    - /cgi-bin/mobile_api
  selection_cmd:
    c-uri|contains: DEVICE_PING
  selection_inject:
    c-uri|contains:
    - '%3b'
    - '%7c'
    - '%60'
    - '%24%28'
    - '%26%26'
    - '%0a'
    - ;
    - '|'
    - '`'
    - $(
  condition: selection_path and selection_cmd and selection_inject
falsepositives:
- Security testing tools replaying public exploit code in a lab
- Vulnerability scanners with injection checks
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e26d58de-a0ff-5a3f-b161-5439fb07a67e/tigo-cloud-connect-advanced-hard-coded-credentials-and-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup