CVE-2025-53520

EG4 Electronics EG4 Inverters Download of Code Without Integrity Check

Description

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.

Remediation

Workaround:

  • EG4 has acknowledged the vulnerabilities and is actively working on a fix, including new hardware expected to release by October 15, 2025. Until then, EG4 will actively monitor all installed systems and work with affected users on a case-by-case basis if anomalies are observed. For more information, contact EG4. https://eg4electronics.com/contact/

Category

8.6
CVSS
Severity: High
CVSS 4.0 •
CVSS 3.1 •
EPSS 0.02%
Affected: EG4 Electronics EG4 12kPV
Affected: EG4 Electronics EG4 18kPV
Affected: EG4 Electronics EG4 Flex 21
Affected: EG4 Electronics EG4 Flex 18
Affected: EG4 Electronics EG4 6000XP
Affected: EG4 Electronics EG4 12000XP
Affected: EG4 Electronics EG4 GridBoss
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
https://eg4electronics.com/contact/

Frequently Asked Questions

What is the severity of CVE-2025-53520?
CVE-2025-53520 has been scored as a high severity vulnerability.
How to fix CVE-2025-53520?
As a workaround for remediating CVE-2025-53520: EG4 has acknowledged the vulnerabilities and is actively working on a fix, including new hardware expected to release by October 15, 2025. Until then, EG4 will actively monitor all installed systems and work with affected users on a case-by-case basis if anomalies are observed. For more information, contact EG4. https://eg4electronics.com/contact/
Is CVE-2025-53520 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-53520 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-53520?
CVE-2025-53520 affects EG4 Electronics EG4 12kPV, EG4 Electronics EG4 18kPV, EG4 Electronics EG4 Flex 21, EG4 Electronics EG4 Flex 18, EG4 Electronics EG4 6000XP, EG4 Electronics EG4 12000XP, EG4 Electronics EG4 GridBoss.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.