Description
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sungrow | iSolarCloud | < 2026-08-25 | 2026-08-25 |