Critical Sungrow Inverter Vulnerability Exposed Cloud Solar Management Platform
A severe security flaw in Sungrow’s iSolarCloud platform a cloud-based system for managing solar plants, inverters, and battery storage could have allowed attackers to bypass password authentication entirely. Discovered by cybersecurity researchers at Jakkaru, the vulnerability stemmed from a business-logic error in the login process, enabling unauthorized access to user accounts with just a valid email address.
The issue affected Sungrow’s global customer base, including energy operators in Europe, China, Australia, and other regions, given the company’s dominance in the solar inverter market. As of June 2025, Sungrow had deployed over 870 GW of power converters worldwide, with estimates surpassing 1,000 GW making the flaw a significant risk to critical energy infrastructure.
How the Exploit Worked
Jakkaru’s analysis revealed that the login_type field in iSolarCloud’s API could be manipulated to authenticate requests without requiring a password. The platform’s security controls including encrypted REST API requests and request signatures failed to prevent this bypass. Once inside, attackers could:
- Access and modify solar plant configurations
- Start or stop inverters and battery systems
- Install malicious firmware on connected devices
- Escalate privileges via compromised admin accounts
The lack of login alerts for this method heightened the risk, as unauthorized access could go undetected. Attackers could further exploit account-recovery features to maintain persistent control.
Potential Impact
Beyond data theft, the vulnerability posed operational risks to energy grids. A coordinated attack could:
- Disrupt solar power generation through mass shutdowns
- Alter device behavior via malicious firmware updates
- Compromise entire regional cloud systems if admin accounts were breached
This incident follows broader concerns about solar inverter security, including a prior study identifying 46 vulnerabilities across major vendors. Sungrow itself had been linked to issues involving insecure communication dongles, hard-coded credentials, and exposed management interfaces with over 35,000 solar systems found publicly accessible online.
Response and Mitigation
Jakkaru reported the flaw to Sungrow’s Product Security Incident Response Team (PSIRT), which issued a hotfix within 24 hours. While the company conducted a deeper review, no CVE identifier, affected firmware list, or patch version was publicly disclosed.
Sungrow’s rapid response was noted as positive, though the incident underscores the need for enhanced cloud security in critical energy infrastructure. The broader trend of internet-exposed solar devices remains a persistent threat, with security experts warning against direct public exposure of inverter dashboards and management interfaces.
Source: https://cybersecuritynews.com/sungrow-inverter-vulnerability/
Sungrow cybersecurity rating report: https://www.rankiteo.com/company/sungrow
"id": "SUN1791477083",
"linkid": "sungrow",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'customers_affected': 'Global customer base, including '
'energy operators',
'industry': 'Renewable Energy, Solar Power',
'location': 'Global (Europe, China, Australia, and '
'other regions)',
'name': 'Sungrow',
'size': '870 GW+ deployed power converters (estimated '
'1,000 GW+ as of June 2025)',
'type': 'Company'}],
'attack_vector': 'API Manipulation',
'data_breach': {'data_encryption': 'Encrypted REST API requests (bypassed via '
'vulnerability)',
'sensitivity_of_data': 'High (operational control of critical '
'energy infrastructure)',
'type_of_data_compromised': 'Solar plant configurations, user '
'account data, admin privileges'},
'description': 'A severe security flaw in Sungrow’s iSolarCloud platform, a '
'cloud-based system for managing solar plants, inverters, and '
'battery storage, could have allowed attackers to bypass '
'password authentication entirely. The vulnerability stemmed '
'from a business-logic error in the login process, enabling '
'unauthorized access to user accounts with just a valid email '
'address. The issue affected Sungrow’s global customer base, '
'including energy operators in Europe, China, Australia, and '
'other regions.',
'impact': {'brand_reputation_impact': 'Significant (global energy '
'infrastructure risk)',
'data_compromised': 'Solar plant configurations, user account '
'data, admin privileges',
'operational_impact': 'Disruption of solar power generation, '
'unauthorized control of inverters and '
'battery systems, potential grid instability',
'systems_affected': 'Sungrow iSolarCloud platform, connected solar '
'inverters, battery storage systems'},
'investigation_status': 'Resolved (hotfix applied)',
'lessons_learned': 'Need for enhanced cloud security in critical energy '
'infrastructure, importance of securing API authentication '
'mechanisms, risks of internet-exposed solar management '
'systems.',
'post_incident_analysis': {'corrective_actions': 'Hotfix to address '
'authentication bypass, '
'deeper security review of '
'iSolarCloud platform',
'root_causes': 'Business-logic error in API '
'authentication (login_type field '
'manipulation), lack of login '
'alerts for bypass method, insecure '
'account-recovery features'},
'recommendations': ['Avoid direct public exposure of inverter dashboards and '
'management interfaces',
'Implement multi-factor authentication (MFA) for '
'cloud-based energy management platforms',
'Conduct regular security audits of business-logic '
'processes in APIs',
'Improve transparency in vulnerability disclosures (e.g., '
'CVE assignments, patch details)'],
'references': [{'source': 'Jakkaru Cybersecurity Research'}],
'response': {'communication_strategy': 'Limited public disclosure (no CVE, '
'affected firmware list, or patch '
'version details)',
'containment_measures': 'Hotfix issued within 24 hours',
'remediation_measures': 'Patch applied to fix business-logic '
'error in login process',
'third_party_assistance': 'Jakkaru (cybersecurity researchers)'},
'title': 'Critical Sungrow Inverter Vulnerability Exposed Cloud Solar '
'Management Platform',
'type': 'Authentication Bypass',
'vulnerability_exploited': 'Business-logic error in login process (login_type '
'field manipulation)'}