CVE-2023-35837 is a critical (9.8) flaw in the SolaX Pocket WiFi 3 module. The web admin password defaults to the device registration ID, which is also broadcast as the Wi-Fi name, and nothing forces a change. No vendor fix is confirmed, so isolate the module.
What's affected
The record says SolaX Pocket WiFi 3 firmware through 3.001.02 is affected. The researcher who reported the issues says it is believed to affect all known firmware versions and that he tested up to and including v3.009.03_20230504. So the two sources disagree on how far the affected range runs. Assume every Pocket WiFi 3 module you have is affected unless SolaX tells you otherwise in writing.
On fixes, the researcher's write up, published 19 January 2024, says there were no known plans to distribute patches to existing owners. SolaX told him it would change the design of future units, for example by hiding the SSID and adding a pre-shared key to the access point, but it had not found a way to deliver security patches to modules already installed. I could not read SolaX's own firmware page, because it did not render without a browser. Check SolaX's download and firmware upgrade pages for anything newer than the researcher's account.
How to check if you're exposed
There is no package to query on a hardware module, so the check is about the device and its settings.
- Confirm that a SolaX inverter with a Pocket WiFi 3 module is installed.
- Compare the module's firmware version with the versions in the section above.
- Ask whoever installed it whether the web admin password was ever changed from the default. If nobody knows, assume it was not, because nothing in the setup process prompts for a change.
The record says the password equals the registration ID and the same ID is the Wi-Fi network name. That means anyone who can see the network name can work out the password. Do not test this yourself on a live site by logging in. Looking at the visible network name and asking the installer is enough.
Keep a note of every site where the answer is unknown.
What to do now
- Locate every Pocket WiFi 3 module and record its firmware version and registration ID.
- If the web admin password can be changed on your firmware, change it to a long unique one now, and store it in your password manager. Confirm with SolaX that this works on your version, since the record says no routine forces it.
- Ask SolaX or the installer whether firmware or hardware that fixes this is available for your units.
- Isolate the module on a network segment with no access to business or home systems.
- Keep the module off the internet and do not forward any ports to it.
- Re-check the module's settings after any reset or firmware change, and keep a record of when the password was last set.
Why it matters
This is a default credential problem. The record says the password protecting the web interface is the device's registration ID, that the same ID is used as the Wi-Fi network name, and that no routine forces a change on first use or tells the user it is still the default. A secret that is also published is not a secret.
The record adds that, once signed in, an attacker can reconfigure the device or upload new firmware, which can lead to denial of service, code execution or privilege escalation. The score of 9.8 follows from a network attack with no privileges, no user interaction and high impact. It is not on CISA's Known Exploited Vulnerabilities list, and I found no report of exploitation.
The researcher describes this as one of three related issues in the same module. The others are the permanent open access point, tracked as CVE-2023-35835, and a disclosure of the network configuration during setup. Fixing one without the others leaves the module weak, so judge it as a whole.
Quick check
Why is a default password rated critical?
Because the password can be derived from the Wi-Fi network name, and the record says an attacker who signs in can reconfigure the device or upload new firmware.
Is there a vendor fix?
None is confirmed. Ask SolaX or your installer, and isolate the module in the meantime.
Sources
Last reviewed: 19 October 2026.
