Overview

Sungrow is committed to maintaining the security of its products, services, and customers. We welcome security researchers, customers, partners, and other stakeholders to responsibly report potential security vulnerabilities that may affect Sungrow products, systems, or services.

By working collaboratively with the security community, we can identify, assess, and remediate security issues more effectively, helping to strengthen the overall security of our products and services.

Scope

This policy applies to all of Sungrow's products.

How to Report a Vulnerability

If you believe you have identified a security vulnerability affecting a Sungrow product or service, please submit your report through one of the following channels:

Security Email
psirt@sungrowpower.com

PSIRT Portal
https://www.sungrowpower.com/en/security-incident-response

To protect the confidentiality of vulnerability information, we recommend using PGP encryption when submitting vulnerability reports.

Information to Include

To facilitate efficient analysis and validation, vulnerability reports should include as much of the following information as possible:

Affected product name and model

Software, firmware, or system version

Detailed description of the vulnerability

Vulnerability type (e.g., privilege escalation, remote code execution, authentication bypass)

Potential impact and risk assessment

Steps required to reproduce the vulnerability

Test environment information

Proof-of-Concept (PoC) code, scripts, logs, screenshots, or other supporting materials

Contact information (optional)

The more complete the information provided, the more efficiently we can evaluate and address the reported issue.

Vulnerability Handling and Response Commitment

Vulnerability reception and confirmation: We will confirm receipt of your report within 1-3 working days.

Vulnerability verification and Assessment: Complete preliminary verification and impact assessment within 7 working days, and provide you with feedback on our remediation plan.

Vulnerability remediation: Develop a repair plan based on the risk level, and develop and test patches.

Customer Notifications and Bulletins: Notify affected customers and issue security bulletins.

For complex vulnerabilities, the processing time may be extended, and we will maintain continuous communication with you during the process of handling the vulnerability.

Coordinated Vulnerability Disclosure

Sungrow addresses security vulnerabilities in accordance with the Coordinated Vulnerability Disclosure (CVD) framework.

Confidentiality of Information: Throughout the entire vulnerability handling lifecycle, Sungrow PSIRT will strictly restrict access to vulnerability information and only share such data with personnel directly involved in resolving the vulnerability. Meanwhile, reporters are requested to keep all vulnerability information confidential until a complete remediation solution is made available to our customers.All vulnerability-related materials you submit (including but not limited to vulnerability descriptions, reproduction steps, PoC code, affected product models, attack chains, test screenshots, etc.) shall be treated as confidential information from the date your vulnerability report is received until both parties reach a written agreement on public disclosure. During this confidentiality period, you must not disclose, distribute or publish any of the aforementioned materials to any third party.

Negotiation of Disclosure Timeline: Once a vulnerability fix is ready for release, we will negotiate with you to finalize the official public disclosure date. Any public release of vulnerability information in any form must be discussed in advance with the Sungrow PSIRT Team, and may only proceed after both sides reach written consensus on the disclosure timeline, content and publication method.Permitted disclosure forms include, but are not limited to:

Safe Harbor

Sungrow appreciates and supports good-faith, responsible security research activities.

For individuals conducting security research in good faith and complying with this Policy, Sungrow commits that it will not initiate lawsuits or take legal action against them, provided all of the following conditions for the research activities are met:

Reproduce vulnerabilities only through verification with minimal impact; do not tamper with, delete or steal business data or device configurations. Immediately terminate testing and submit a report upon accessing any sensitive data.

Do not cause service disruption to customers, partners or Sungrow.

Do not launch Denial-of-Service (DoS) attacks.

Do not leverage vulnerabilities for lateral movement, persistent control or further exploitation attacks.

Do not profit from vulnerabilities, engage in extortion, or trade vulnerability information.

Do not violate any applicable laws and regulations.

Do not publicly disclose vulnerability details before the corresponding patch is fully released.

Sungrow reserves the right to take appropriate measures if any research activity falls outside the scope specified above.

Personal Safety Tips

Some products of Sunshine power supply involve high-voltage power equipment, which has safety risks such as electric shock and arc. Investigators should conduct tests in a safe environment, comply with electrical work safety regulations, and wear appropriate personal protective equipment when necessary.

Acknowledgements And Recognition

Sungrow appreciates the valuable contributions of the security research community.

For valid and responsibly reported vulnerabilities, Sungrow may acknowledge the reporter's contribution. With the reporter's consent, recognition may be provided through security advisories, acknowledgments, or other appropriate channels.

Currently, Sungrow does not operate a public bug bounty program. Should such a program be introduced in the future, detailed information will be published on the official website.

Contact

For questions regarding this VDP or other product security matters, please contact Sungrow PSIRT:psirt@sungrowpower.com