Critical Sungrow Flaw Lets Attackers Take Control of Solar Power Plants Worldwide

A critical authentication bypass in Sungrow's iSolarCloud platform allowed authentication-as-any-user (including administrators) by changing a login_type parameter to 5, affecting four regional deployments and potentially permitting listing, modification, start/stop of solar plants, inverters, battery systems, and installation of firmware; researchers reported the issue and Sungrow deployed a hotfix within a day, and the report contains no evidence of observed exploitation.