Critical Sungrow Authentication Bypass Flaw Lets Hackers Take Control of Solar Power Plants

A researcher disclosed a critical business-logic authentication bypass in Sungrow’s iSolarCloud (all regional environments) that allowed attackers to authenticate as any account by using a specific login_type value, bypassing passwords. The flaw could enable account takeover, administrative control of solar plants, inverters, and batteries, and even deployment of custom firmware; Sungrow deployed a hotfix within a day and is investigating, and no confirmed active exploitation or CVE was reported.