CVE-2023-35835 is a critical (9.8) flaw in the SolaX Pocket WiFi 3 module. Its setup Wi-Fi network has no password, stays on after setup, and serves a configuration page and an unauthenticated ModBus interface. No vendor fix is confirmed, so isolate the module.
What's affected
The record says SolaX Pocket WiFi 3 firmware through 3.001.02 is affected. The researcher who reported the issues says it is believed to affect all known firmware versions and that he tested up to and including v3.009.03_20230504. So the two sources disagree on how far the affected range runs. Assume every Pocket WiFi 3 module you have is affected unless SolaX tells you otherwise in writing.
On fixes, the researcher's write up, published 19 January 2024, says there were no known plans to distribute patches to existing owners. SolaX told him it would change the design of future units, for example by hiding the SSID and adding a pre-shared key to the access point, but it had not found a way to deliver security patches to modules already installed. I could not read SolaX's own firmware page, because it did not render without a browser. Check SolaX's download and firmware upgrade pages for anything newer than the researcher's account.
How to check if you're exposed
This is a hardware module, so there is no package to query. Check it with your eyes and your phone.
- Work out whether you have a SolaX inverter with a Pocket WiFi 3 dongle fitted. It is the small Wi-Fi module that connects the inverter to your home or site network.
- Stand near the inverter and look at the Wi-Fi networks your phone can see. A network named after the device, with no padlock, is the permanent open access point described in the record.
- Note the module's firmware version from the SolaX app or the module's own page, and compare it with the versions above.
Do not connect to the open network from a machine you care about, and do not send commands to the inverter to test it. Seeing the network is enough to know you are exposed.
Installers and facilities teams often know which sites have these modules, so ask them before you walk the estate.
What to do now
- Find every site with a SolaX inverter and Pocket WiFi 3 module, and record the firmware version.
- Contact SolaX or your installer and ask in writing whether a firmware update or a replacement module is available for your serial numbers.
- Put the inverter's network connection on its own segment, with no route to business or home devices, so a compromised module cannot reach anything else.
- Treat the inverter's ModBus interface as unprotected. Do not rely on obscurity, and do not expose the module to the internet.
- Where the module is not needed for monitoring, consider removing it from the inverter, after checking with your installer that this is safe for your warranty and monitoring setup.
- Add the devices to your asset inventory with an owner and review date, since there may be no patch to track.
Why it matters
The record does not assign a CWE, but the description is plain. The setup Wi-Fi network has no authentication, it never turns off after setup, and it exposes a web configuration page and a ModBus interface that needs no login. ModBus is an industrial protocol that reads and writes device values, and it was designed for trusted wired networks, not open radio.
The score of 9.8 reflects a network attack with no privileges and no user interaction, and high impact on confidentiality, integrity and availability. The researcher notes that someone within radio range could change inverter settings and that the module also holds the network details of the site network. It is not in CISA's Known Exploited Vulnerabilities catalogue, and the sources I read do not report exploitation in the wild.
The harder lesson is about lifecycle. Many connected energy and building devices have no way to receive security updates. When a flaw like this appears, the only controls are network isolation and replacement. Plan for that before you buy.
Quick check
Is there a patch for this?
None is confirmed. The researcher's January 2024 write up says SolaX had no known plan to patch existing modules. Ask SolaX or your installer for the current status.
Can I be attacked from the internet?
The record describes access through the module's own Wi-Fi network, so an attacker would need to be within radio range or on a network that can reach the module. Keep it off the internet either way.
Sources
Last reviewed: 19 October 2026.
