CISA Alerts on Critical SunPower Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) yesterday issued a high-severity alert (ICSA-25-245-03) regarding a critical vulnerability in SunPower’s PVS6 solar inverter series that allows attackers on adjacent networks to gain complete control of the device.
Rated 9.4 out of 10 on the CVSS v4 scale, the vulnerability stems from hard-coded credentials in the Bluetooth Low Energy (BLE) servicing interface and poses an urgent risk to energy infrastructure worldwide.
CISA’s executive summary warns that successfully exploiting this weakness could enable adversaries to replace firmware, alter grid settings, disable power production, establish unauthorized SSH tunnels, and manipulate connected devices.
Given the PVS6’s widespread deployment in residential and commercial solar installations, exploitation could disrupt power generation, damage equipment, or facilitate broader attacks on industrial control systems (ICS).
SunPower PVS6 units running firmware versions 2025.06 build 61839 and earlier are confirmed vulnerable.
The vulnerability, tracked as CVE-2025-9696, arises from the use of hard-coded encryption parameters and public protocol details in the BLE interface.
An attacker within Bluetooth range—approximately 50 meters under ideal conditions—can leverage these credentials to access the device’s servicing port, designed for maintenance operations.
Because the vulnerability is exploitable with low complexity and requires no user interaction or prior privileges, it poses a significant threat to critical infrastructure.
CISA emphasizes that while the attack cannot be launched remotely over the internet, many installations expose Bluetooth interfaces without proper network segmentation, effectively placing devices within reach of malicious actors.
CISA’s advisory details that hard-coded credentials allow decryption and unauthorized commands to the servicing interface.
Once inside, attackers can upload malicious firmware images, introduce persistent backdoors, and reconfigure firewall and network settings to maintain access or pivot to other ICS assets.
SunPower has not publicly responded to CISA’s coordination requests. In the interim, CISA recommends the following defensive measures:
CISA also directs organizations to its ICS recommended practices portal for further guidance, including “Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies” and “Targeted Cyber Intrusion Detection and Mitigation Strategies.”
To guard against social engineering, users should avoid clicking unsolicited links or attachments and consult CISA’s phishing and email scam resources.
While CISA has not received reports of active exploitation targeting CVE-2025-9696, the advisory stresses that the vulnerability remains dangerous until patched. Organizations are urged to treat this as a high-priority remediation task.
Owners of SunPower PVS6 devices should immediately verify firmware versions and seek updated releases from SunPower.
As CISA continues to monitor incident reports, any observed malicious activity should be reported to CISA’s Incident Response Team for correlation and wider community protection.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…