A login flaw in Sungrow's solar cloud could have let attackers switch off about 250,000 installations in Germany
October 7, 2026 (Found late August; published October 7 to 8, 2026)
German security researcher Marlon Starkloff of Jakkaru found in late August that the login for Sungrow's iSolarCloud platform could be tricked into skipping the password check. Setting a login-type parameter to a particular value gave access to accounts without a valid password, and the platform raised no alert. According to reporting based on Die Zeit, the researchers went from user accounts to management accounts at German installers Enpal and 1KOMMA5° and then to Sungrow's own administrator accounts. With that access an attacker could have started or stopped inverters, controlled battery storage or installed new firmware. About 250,000 Sungrow installations in Germany were in reach, with about 470,000 in Europe and about 2.2 million worldwide. An expert quoted in the report said that about 3 GW switched off at once could cause a blackout like the one in Spain. The researchers did not run such commands on other people's systems. Sungrow confirmed the flaw, closed it with an emergency fix within a day and says attackers did not exploit it.
Why it matters
Solar inverters are controlled from the manufacturer's cloud, so one flaw in a login page can become a lever on a whole fleet across a country's grid. The same fleet-wide reach would apply to any vendor whose cloud can command many inverters.
What defenders can take from it
- Manufacturers: check authentication on the server for every login path, alert on administrator logins that skip normal steps, and sign firmware.
- Grid operators and regulators: map how many inverters one vendor's cloud can control, and test what a coordinated switch-off would do.
- Owners: keep inverter apps and firmware updated and use a unique password for the account.