Chinese solar PV inverter and energy storage manufacturer Sungrow has patched a vulnerability in its iSolarCloud platform that allowed access to platform accounts without the required authentication, according to the company.
The vulnerability was made public last week by German cybersecurity firm Jakkaru, which said on LinkedIn that it had been able to gain access to “all Sungrow solar systems installed worldwide,” accounting for gigawatts of power generation capacity. Jakkaru’s Marlon Starkloff noted that on the Sungrow platform, “normal user accounts and administrative user accounts share the same management platform,” which means that accessing a normal user account could leave an administrative account exposed and create a “dangerous scenario”.
Try Premium for just $1
- Full premium access for the first month at only $1
- Converts to an annual rate after 30 days unless cancelled
- Cancel anytime during the trial period
Premium Benefits
- Expert industry analysis and interviews
- Digital access to PV Tech Power journal
- Exclusive event discounts
Or get the full Premium subscription right away
Or continue reading this article for free
Starkloff explained in a blog post that the Sungrow platform has at least eight types of login process, and that by setting the process to number five, “we were immediately logged in”.
“The password field is ignored,” wrote Starkloff. “This was a critical finding. What made it worse, was the fact that no notification was sent to the user. No login notification by email or similar.”
An independent security researcher working with Jakkaru informed Sungrow of the vulnerability on 22 August. Sungrow reproduced the attack and deployed an emergency patch across all iSolarCloud levels on 25 August, resolving the underlying issue the same day. The company then conducted follow-up testing in mid-September, which found the vulnerability could no longer be reproduced.
Jakkaru added that Sungrow performed an examination of platform logs covering the period during which the vulnerability existed and found no evidence that anyone other than the reporting researcher had exploited it. The company also reported no evidence of customer data leaks, service interruptions or unauthorised manipulation of customer systems.
Sungrow said the vulnerability affected its cloud infrastructure rather than a specific inverter model or product series. However, the company emphasised that critical functions, including firmware updates and device controls, require additional authentication protections, such as password verification and two-factor authentication.
According to the company, these safeguards prevented the vulnerability from being used to conduct unauthorised mass operations on connected devices.
Sungrow said cybersecurity remains a high priority as its platforms support the management of distributed energy systems. It has commissioned an independent security assessment by NCC Group to further examine its security arrangements.
The company said it would implement additional improvements based on the assessment’s findings and recommendations. It also expressed support for mandatory and verifiable cybersecurity requirements for platforms managing distributed energy infrastructure at scale.
Sungrow’s reported remediation measures include the emergency patch, subsequent testing and an independent security assessment. The company said its investigation found no evidence of wider exploitation or unauthorised interference with customer systems during the period in question.
PV Tech contacted Sungrow for comment but had not received a response at the time of publication.
Speaking to our sister publication Energy-Storage News, Sungrow North America’s Michael Hudson said the company follows cybersecurity frameworks, including IEC 62443, and incorporates security measures throughout product development. He highlighted access controls, network segmentation and firmware integrity as key safeguards for connected energy systems.
Hudson also said Sungrow has commissioned independent product testing and is expanding its cybersecurity programme as digital connectivity across energy infrastructure increases.
Understanding technology and supplier selection for Europe’s utility-scale PV market in 2027. PV ModuleTech Europe 2026 is a two-day conference that tackles these challenges directly, with an agenda that addresses all aspects of PV module, inverter and battery supplier selection; product availability, technology offerings, supply chain traceability, quality assurance, factory auditing, system reliability, and supplier bankability.
EU expert group warns of solar cybersecurity risks as PV capacity targets 718GW by 2030
The report follows a series of cybersecurity disclosures involving solar inverters and connected energy infrastructure. This month, the European Commission’s Smart Energy Expert Group (SEEG) identified three high-risk scenarios that could expose Europe’s electricity system to disruption as PV capacity expands.
The report identified attacks on manufacturers’ cloud platforms, intentional backdoors introduced on behalf of nation-state actors and attacks on utility-scale installations through local networks and remote-access infrastructure as three high-risk scenarios.
The experts warned that exploiting connected installations could allow attackers to disrupt electricity generation at scale. The report highlighted concerns about vulnerabilities discovered in inverter equipment and manufacturer platforms, alongside geopolitical tensions and Europe’s dependence on Chinese-made PV equipment.
In April 2026, the European Commission reportedly barred EU funding for energy projects using Chinese-made inverters, excluding equipment from countries deemed high-risk from major financing instruments, including the European Investment Bank and European Investment Fund.
To address the risks, SEEG recommended requiring manufacturers of internet-connected devices to establish robust vulnerability-handling processes and enforceable timelines for security patches. It also encouraged bug bounty programmes to support independent security research.
For utility-scale installations, the group recommended restricting inverter communications to documented, encrypted and authenticated connections, with outbound traffic limited to approved servers in the EU or equivalent jurisdictions.
The report also called for tighter controls on firmware updates at commercial, industrial and utility-scale installations, recommending controlled manual updates by qualified maintenance providers instead of manufacturer-triggered automatic updates.
On regulation, SEEG said the EU’s Cyber Resilience Act (CRA) does not provide sufficient verification to enforce all its recommended measures. It proposed classifying PV inverters as Class II important products, requiring independent conformity assessments by notified bodies.
The report further recommended addressing supply-chain risks through restrictions on components and software from suppliers considered high-risk under proposed EU cybersecurity legislation.
SEEG said cybersecurity scenarios involving solar generation should also be incorporated into electricity system risk assessments as Europe’s installed PV capacity expands.
Speaking to PV Tech Premium in February 2026, cybersecurity experts said the European Commission’s proposed Cybersecurity Act revision could tighten restrictions on high-risk suppliers and reshape cybersecurity requirements for Europe’s renewable energy infrastructure [subscription required].
