Solar Power Installations Worldwide Open to Cloud API Bugs

Bitdefender disclosed critical cloud API vulnerabilities in the Solarman and Deye inverter-management platforms that allowed unauthorized token generation, exposed PII and device metadata (including GPS and real-time production), and in Deye's case relied on a hardcoded credential; successful exploitation could let attackers modify inverter settings or force abnormal power flows, potentially destabilizing power-grid segments, though vendors were notified and have remediated the issues.