Authentication Bypass in Sungrow’s iSolarCloud Could Let Attackers Seize Control of Solar Facilities

Security researchers have uncovered a critical authentication bypass flaw in Sungrow’s iSolarCloud platform, a cloud‑based service used to monitor and manage solar power installations worldwide. The vulnerability enables an attacker to log into both user and administrator accounts without supplying a valid password, potentially granting unfettered access to connected inverters, battery storage units and entire solar farms.

The issue was first reported by the independent security group GBHackers, who demonstrated that the flaw could be exploited to bypass the platform’s login checks. By crafting specially formatted requests, the researchers were able to assume the privileges of any account, including those with the authority to modify system settings, shut down generation, or alter performance data.

Sungrow, a leading Chinese manufacturer of photovoltaic inverters and energy storage solutions, provides iSolarCloud to a broad customer base that includes utility‑scale operators, commercial developers and residential owners. The platform’s appeal lies in its ability to aggregate data from dispersed assets, allowing operators to optimize output and perform remote diagnostics. A breach of this nature therefore raises concerns about the resilience of critical energy infrastructure that increasingly depends on cloud‑enabled control interfaces.

While the exact number of installations that use iSolarCloud is not disclosed, industry estimates suggest that millions of kilowatts of solar capacity could be managed through the service. An attacker who gains administrator rights could, in theory, disrupt power generation, conceal equipment failures, or manipulate output readings that feed into market settlements. The potential for coordinated attacks on multiple sites also heightens the risk of cascading effects on grid stability.

Sungrow has acknowledged the report and indicated that a security patch is being prepared. The company advises customers to apply any forthcoming updates promptly and to review access controls, such as multi‑factor authentication and network segmentation, as interim mitigations. Cyber‑security experts emphasize that organizations should treat cloud‑based energy management tools with the same rigor applied to traditional IT systems, including regular vulnerability assessments and incident‑response planning.

The discovery adds to a growing list of cyber‑security challenges facing the renewable‑energy sector, where the convergence of operational technology and internet connectivity creates new attack surfaces. Analysts note that as solar installations scale up and become more integrated with smart‑grid initiatives, manufacturers and operators must embed robust security measures from design through deployment.

Regulators in several jurisdictions have begun to issue guidance on securing distributed energy resources, but enforcement remains uneven. The Sungrow flaw underscores the need for industry‑wide standards and clearer accountability for software vulnerabilities that could impact public power supplies.

As patches roll out, stakeholders are watching for signs of exploitation in the wild. Until then, the incident serves as a reminder that the rapid digitalization of renewable energy must be matched by equally rapid advances in cybersecurity practices.