Is CVE-2025-7770 actively exploited?

No active exploitation of CVE-2025-7770 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-7770 be exploited remotely?

Yes. CVE-2025-7770 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-7770?

CVE-2025-7770 has a CVSS score of 8.7 (HIGH).

HOME VULNERABILITIESCVE-2025-7770

HIGH

CVE-2025-7770

CWE-337Published: August 6, 2025· Updated: Jun 17, 2026

8.7

CVSS v3.1

Official Description

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.

NVD Source

Technical Analysis

CVE-2025-7770 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X