An ethical hacker bypassed password checks in Sungrow’s iSolarCloud platform, potentially exposing administrative controls over solar systems with 28GW of registered European capacity.
Marlon Starkloff, an ethical hacker and software developer, has exposed what security researchers say was a serious weakness in Sungrow’s iSolarCloud platform, after he found a way to reach administrative access without knowing a user password. According to reporting by CHIP and corroborating summaries from other German outlets, the flaw emerged in August 2026 and affected a cloud system used to manage a very large installed base of solar equipment. In Germany alone, the platform was linked to about 250,000 Sungrow systems with a combined peak output of 7.8 gigawatts.
The method was unusually simple. Starkloff altered a value in the login request and, in doing so, could impersonate another account once he knew the e-mail address associated with it. Jakkaru, the security firm he works with, says the system did not re-check the password and did not alert the legitimate account holder that someone else had signed in. From there, he was able to move through connected accounts until he reached higher-level administrative privileges. Reports based on the wider investigation say the same weakness was present in Sungrow’s European, Chinese, Australian and international iSolarCloud environments.
That raised concern well beyond a single vendor account. Data cited by ZEIT and repeated in later coverage indicate that around 220,000 additional systems outside Germany were tied to the platform in Europe, taking the total European base to roughly 470,000 installations and about 28 gigawatts of registered capacity. At one point, the dashboard reportedly showed nearly 18 gigawatts of live feed-in. That figure does not prove that all those systems could have been shut down at once, but it does underline why central cloud control of decentralised energy assets is treated as a grid-security issue. The Bundesamt für Sicherheit in der Informationstechnik has warned that platforms of this kind can concentrate critical power-system functionality in one place.
Sungrow says it fixed the weakness within a day and found no evidence that anyone else had used it before disclosure. The company classified the issue as CVE-2026-107194 and gave it a severity score of 9.2 out of 10, according to its security notice. It also said that the most sensitive actions on the platform still required an extra password check or two-factor authentication, a point that Starkloff disputes. He argues that once administrative access was obtained, systems could be started, stopped or modified, and that malicious firmware could in theory have been pushed to inverters or batteries to trigger a delayed shutdown. What both sides appear to agree on is that a password check could be bypassed, and that is enough to justify the alarm that followed.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
