Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-15575 The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update fil… https://www.cve.org/CVERecord?id=CVE-2025-15575
Post summary
CVE‑2025‑15575 is disclosed as a flaw in firmware update validation, permitting attackers to install malicious firmware.
CVE-2025-15573, CVE-2025-15574, CVE-2025-15575 Multiple Vulnerabilities in various Solax Power Pocket WiFi models - SEC Consult https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-various-solax-power-pocket-wifi-models/
Post summary
The advisory announces three CVEs (CVE-2025-15573, CVE-2025-15574, CVE-2025-15575) that affect Solax Power Pocket WiFi models, but no detailed technical or exploitation information is included.