CVE-2025-24861 is a high severity command injection flaw (CVSS 7.5) in the OutBack Power Mojave inverter, model OGHI8048A, where specially crafted POST requests can inject commands. The record lists no fixed version. Read the CISA advisory ICSA-25-044-17, keep the device off the internet, and isolate it from other networks.
What's affected
The NVD record names the OutBack Power Mojave Inverter OGHI8048A and its firmware. Its description is brief: an attacker may inject commands via specially crafted post requests. The record does not list a version range, so check the CISA advisory and the vendor for which firmware builds are affected.
The vector shows network access, low complexity, no privileges and no interaction, with high impact on confidentiality only. The record is not on the CISA Known Exploited Vulnerabilities list, although CISA published an industrial control systems advisory for it, ICSA-25-044-17.
The weakness is classed as CWE-77 (command injection). The score is 7.5 (HIGH). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, no on integrity and no on availability. The record was published on 2025-02-13.
The record gives no fixed version and I could not read the advisory detail. Open ICSA-25-044-17 and the vendor contact page listed in the record, and ask the vendor which firmware, if any, addresses it. Do not assume a patch exists.
How to check if you're exposed
This is power equipment, so be careful and work with the person who owns the site.
- Identify any Mojave inverter, model OGHI8048A, in your sites, and record its firmware version from the device interface or the paperwork.
- Check how it is connected. A device on a private management network is a lower concern than one with a public address.
- Ask your network team whether any port forwarding or remote access path points at the inverter's web interface.
- Review firewall rules for traffic into the network segment that holds the inverter.
Do not scan or send test requests to operational energy equipment without the owner's written approval.
What to do now
- Take inventory of OutBack Mojave inverters and where they sit on your networks.
- Make sure none of them is reachable from the internet, and remove any port forwarding that points to them.
- Place them behind a firewall in a separate segment and allow only the management addresses that need access.
- Follow the mitigation steps in CISA advisory ICSA-25-044-17 and contact OutBack for firmware information.
- Use a VPN with strong authentication for remote access, and keep it patched.
Why it matters
Command injection, listed as CWE-77, happens when software builds an operating system command from input and does not separate the data from the instruction. A crafted request can then add commands of its own. On embedded devices the web interface often runs with wide rights, so the effect can be larger than the score suggests.
Energy and building systems have long service lives and slow patch cycles. The usual defence is not a quick fix but reducing exposure: no direct internet access, network segmentation and a managed way in. CISA publishes these advisories to help owners do exactly that.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Is there a firmware update for CVE-2025-24861?
The record lists none. Open CISA advisory ICSA-25-044-17 and ask OutBack Power for current guidance.
Is it on the CISA Known Exploited list?
No. The record's KEV flag is false. CISA did publish an ICS advisory about it, which is a different thing from a known exploited listing.
Sources
- Safeguard Gold entry for CVE-2025-24861
- NVD record data for CVE-2025-24861 (published 2025-02-13)
- CISA ICS advisory ICSA-25-044-17 (listed in the record)
Last reviewed: 19 October 2026.
