CriticalCVE
Critical Sungrow Inverter Vulnerability Lets Attackers Access Solar Plants Without Passwords
Cyber Security News·Source published ·1 min read
What happened?
A critical Sungrow inverter vulnerability could have allowed attackers to log in to the company’s iSolarCloud management platform without a valid password. The flaw affected the cloud service used to manage solar plants, inverters, and battery storage systems, creating a serious risk for customers and energy operators in Europe, China, Australia, and other regions. Sungrow Inverter Vulnerability According to research published by Jakkaru, the flaw was a business-logic error in iSolarCloud’s login process.
Key details
- Attackers could bypass password and log into iSolarCloud management.
- The bypass exploited a login_type value that ignored the password field.
- No email or login alert was sent, allowing stealthy access.
- Sungrow released a hotfix within a day after being notified.
Fixes and mitigations
- Owners should ensure iSolarCloud accounts and devices are fully updated.
What to look for
- No email or login alert is generated when the bypass is used.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.