Tigo Energy vulnerabilities
We track 3 vulnerabilities in Tigo Energy products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2025.
Latest Tigo Energy vulnerabilities
- 8.7 High severity
Cloud Connect Advanced: Predictable Seed in Pseudo-Random Number Generator (PRNG)
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the abil
- 8.7 High severity
Cloud Connect Advanced: Improper Neutralization of Special Elements used in a Command
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this ena
- 9.3 Critical severity
Cloud Connect Advanced: Use of Hard-coded Credentials
Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifyin