{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "cveId": "CVE-2026-80304",
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "title": "Authentication bypass via weak HMAC signing key in EYE-SV600 web management interface",
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "cweId": "CWE-1391",
              "description": "CWE-1391 Use of Weak Credentials",
              "type": "CWE"
            }
          ]
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "Sungrow",
          "product": "EYE-SV600 (EyeM4 logger)",
          "packageName": "webserver.so",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThanOrEqual": "002.00.P029B001",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The EYE-SV600 (EyeM4 logger) web management interface uses an HMAC-based request authentication mechanism whose signing key is inadequately secured. An attacker with network access to the device can crack the signing key and forge valid request signatures, bypassing authentication to access protected API functions.",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "The EYE-SV600 (EyeM4 logger) web management interface uses an HMAC-based request authentication mechanism whose signing key is inadequately secured. An attacker with network access to the device can crack the signing key and forge valid request signatures, bypassing authentication to access protected API functions."
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://csirt.divd.nl/CVE-2026-80304",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV4_0": {
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "vulnAvailabilityImpact": "HIGH",
            "subAvailabilityImpact": "NONE",
            "exploitMaturity": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "valueDensity": "NOT_DEFINED",
            "vulnerabilityResponseEffort": "NOT_DEFINED",
            "providerUrgency": "NOT_DEFINED",
            "version": "4.0",
            "baseSeverity": "CRITICAL",
            "baseScore": 9.3,
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Victor Pasman (DIVD)",
          "type": "analyst"
        },
        {
          "lang": "en",
          "value": "Ian van der Wurff (Tozetta)",
          "type": "finder"
        }
      ],
      "source": {
        "advisory": "CVE-2026-80304",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  }
}