Critical Sungrow Authentication Bypass Flaw Lets Hackers Take Control of Solar Power Plants
Researchers disclosed a critical Sungrow iSolarCloud authentication bypass that could let attackers control connected solar plants.
On October 7, 2026, researcher Marlon Starkloff disclosed a critical authentication-bypass flaw in Sungrow’s iSolarCloud platform across Europe, China, Australia, and International environments. A business-logic error in login handling let researchers access user and administrator accounts without valid passwords and then reset those passwords. Administrative access could control plants, inverters, and batteries, reveal accounts including German distributors 1KOMMA5° and Enpal, and potentially push custom firmware. Sungrow issued a hotfix within a day; the report gives no CVE and does not confirm exploitation or outages.
- The flaw affected Europe, China, Australia, and International iSolarCloud regions.
- Sungrow deployed a hotfix within a day of the October 7 disclosure.
- Admin access could start or stop plants, inverters, and batteries.
- Researchers also described a path to deploy custom device firmware.
- No CVE was published and in-the-wild exploitation was not confirmed.
- Vendors
- Sungrow
- Products
- iSolarCloud
From the original article
2 min read at gbhackers.com
A critical authentication bypass vulnerability in Sungrow’s iSolarCloud management platform allowed researchers to access user and administrator accounts without valid passwords. This flaw potentially exposed connected solar plants, inverters, and battery storage systems to unauthorized control.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.