by Kastro
Paper/Archive/CVE-2025-4822

CVE-2025-4822

Bayraktar Solar Energies ScadaWatt Otopilot — SQLi in Bayraktar Solar Energies' ScadaWatt Otopilot

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.2.552 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025.

Affected

ProductAffectedFixed inSource
ScadaWatt Otopilot< 27.05.202527.05.2025CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0175refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0175