by Kastro
Paper/Archive/CVE-2026-107194

CVE-2026-107194

Sungrow iSolarCloud — Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentia…

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
35
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 38.8.388 × 207.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.

Affected

ProductAffectedFixed inSource
iSolarCloud< 2026-08-252026-08-25CNA

Scores by source

mitre (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:P
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsungrowpower.com/en/products/cloud-software/isolarcloudrefjakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwiderefsungrowpower.com/en/login-bypass-vulnerability-in-sungrow-isolarcloudreflinkedin.com/posts/patrick-lamplmair-0aa66715b_otsecurity-gridsecurity-solarenergy-activity-7514199420771393536-HAi3refpv-magazine.com/2026/10/08/sungrow-patches-isolarcloud-vulnerability-after-security-researchers-gain-accessrefpv-tech.org/sungrow-patches-cloud-vulnerability-affecting-solar-inverters