A critical authentication flaw in Sungrow’s iSolarCloud platform briefly allowed a researcher to reach administrator access across systems linked to hundreds of thousands of solar installations, highlighting the risks of concentrating distributed energy assets in one cloud service.
A login flaw in Sungrow’s iSolarCloud platform briefly gave an ethical hacker far broader access than it should have done, raising fresh questions about how much control cloud-connected solar systems should ever place in a single remote service. According to Chip and related reporting, the issue was identified by the security researcher Marlon Starkloff in August 2026 and was tracked by Sungrow as CVE-2026-107194, which the company rated as critical. Sungrow says it repaired the problem on its servers on 25 August 2026 and found no evidence that outsiders had exploited it before the fix.
The weakness was not a complex break-in. Starkloff changed a value in the login request and was then treated as another user, with the system no longer checking the password, according to the security firm Jakkaru. From there, the researcher was able to move through linked accounts until he reached administrative access. Jakkaru says the same flaw existed across iSolarCloud’s European, Chinese, Australian and international systems, meaning the problem was not confined to one region or one customer group.
In Germany alone, the platform was connected to almost 250,000 Sungrow systems with a combined peak capacity of 7.8 gigawatts, according to data reviewed by Die Zeit and cited in later coverage. Across Europe, the figure was about 220,000 additional installations, with total registered capacity of roughly 28 gigawatts. A dashboard screenshot at one point showed almost 18 gigawatts of live feed-in, although that number reflects current output rather than proof that every connected unit could have been switched off at once.
That distinction matters. The figures show the scale of the fleet linked to the cloud service, but they do not by themselves prove that a single attacker could have simultaneously shut down all of those systems. Still, the concentration of so much distributed generation behind one remote control layer has alarmed cybersecurity specialists. According to reporting by Die Zeit, the Federal Office for Information Security has warned that centrally managed cloud platforms can gather a critical amount of power-system capability in one place.
Sungrow disputes the more alarming interpretation of the flaw. The company told PV Magazine that the most sensitive commands were protected by an additional password prompt or two-factor authentication, and that its log review found no sign of data theft, tampering or prior abuse. Starkloff, by contrast, said he could start, stop and alter systems once he had obtained administrator rights, and he argued that the ability to push modified firmware to inverters or batteries could have been especially dangerous. For customers, Sungrow says no local update is needed because the correction was made on the server side. It also advises users to keep passwords strong and unique and to remain alert to security guidance from their installers.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
