Critical Sungrow Authentication Bypass Flaw Lets Hackers Take Control of Solar Power Plants

A critical authentication bypass vulnerability in Sungrow’s iSolarCloud management platform allowed researchers to access user and administrator accounts without valid passwords.

This flaw potentially exposed connected solar plants, inverters, and battery storage systems to unauthorized control.

On October 7, 2026, Marlon Starkloff disclosed these findings, highlighting a business logic flaw affecting all four regional iSolarCloud environments: Europe, China, Australia, and International.

After the notification, Sungrow deployed a hotfix within a day and began investigating the root cause and related issues.

Sungrow Authentication Bypass Flaw

iSolarCloud employs application-layer encryption for REST API communications. While POST request bodies are encrypted, signatures and custom headers offer additional request verification. These security measures complicated testing but did not prevent the underlying authentication failure.

Researchers initially examined password resets and email code authentication, but aggressive rate limiting blocked these potential attack vectors. They then analyzed the decrypted login request, which included the fields `user_account`, `user_password`, and `login_type`.

Normal password authentication used a `login_type` of 1, while email code authentication used 8. After testing other values, they found that setting `login_type` to 5 allowed them to authenticate as the account specified in `user_account`, regardless of the submitted password.

Tests on additional accounts confirmed that this behavior was not due to a previously authenticated session. Additionally, the researchers reported that affected users received no email notification upon login, making the unauthorized access undetected.

Once authenticated, an attacker could use the platform’s password reset functionality to turn unauthorized access into a full account takeover.

The attack required identifying a valid account email address. Researchers identified two discovery paths: organizational hierarchy information visible to users and a separate, undisclosed information leak exposing support and some administrator addresses.

Since both ordinary users and administrators shared the management platform, targeting a privileged account could escalate the compromise beyond a single installation.

According to the disclosure, gaining administrative access allowed attackers to list, modify, start, or stop plants, inverters, and battery systems associated with the compromised regional server. It also revealed registered organizations and users, including management accounts linked to German solar distributors 1KOMMA5° and Enpal.

Furthermore, researchers reported the ability to deploy custom firmware to cloud-connected devices, creating a potential pathway for persistent device compromise.

Sungrow’s considerable scale makes the security of centralized management critical. Their corporate announcement noted that, by June 2025, it had over 870 GW of installed power electronic converters worldwide. However, it does not specify how much capacity the vulnerable platform exposed.

The disclosure warns that coordinated disruption could threaten electricity infrastructure. However, it does not confirm whether attackers exploited the vulnerability or caused any blackouts, and it provides no CVE identifier or specific affected capacity.

Starkloff commended Sungrow’s product security incident response team for effective communication and rapid remediation. The researchers recommended reducing unnecessary cloud connectivity and separating administrative systems from customer platforms.

The central takeaway is that encrypted requests and signature checks cannot compensate for flawed server-side authentication logic, especially when a single management service oversees a vast number of energy assets across different regions.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.