A critical vulnerability in Sungrow inverters recently permitted unauthorized access to the iSolarCloud management platform without necessitating a password. This flaw posed significant security risks for energy operators and customers worldwide, including regions such as Europe, China, and Australia.
Sungrow Vulnerability Details
Research conducted by Jakkaru revealed a business-logic error in the login process of iSolarCloud. This flaw was quickly addressed by Sungrow, who implemented a fix within 24 hours after being alerted. The company is now conducting a thorough investigation to identify the root cause and any other potential vulnerabilities.
Sungrow, a major player in the solar inverter industry with over 1,000 GW of power electronic converters deployed globally, particularly in Europe, faced a significant challenge. The iSolarCloud platform, essential for remote solar asset management, was found to have encrypted REST API requests and custom headers that did not mitigate the login issue.
Potential Risks of the Security Flaw
The investigation uncovered that modifying a parameter called login_type in the login request allowed unauthorized access to accounts without a password, provided the attacker knew the user’s email. No alerts were triggered for such logins, raising concerns over unnoticeable account breaches.
This vulnerability could have led to privilege escalation, particularly if an administrative account was compromised, granting extensive control over solar plants. Such access could include altering plant operations, firmware updates, and potential disruptions in energy generation.
Preventive Measures and Industry Response
In response to this incident and similar vulnerabilities across the industry, Sungrow’s Product Security Incident Response Team (PSIRT) took swift action, issuing a hotfix promptly. However, the report lacked details such as a CVE number or a list of affected firmware.
Owners of solar plants using iSolarCloud should ensure their systems are updated, change passwords, enable multi-factor authentication, and review access permissions. Reducing cloud access to essential functions and isolating administrative systems from customer portals are recommended to mitigate risks.
As solar energy systems become integral to national grids, the importance of securing them against cyber threats increases. This incident highlights the need for robust security measures in managing renewable energy infrastructures.
