【Security Advisory】HMAC authentication bypass in EYE-SV600 web management interface (SGSA-202606-0007)
Publish Date: 20261111
Advisory ID: SGSA-202606-0007
Product: EYE-SV600 (EyeM4)
CVE ID: CVE-2026-80304
Severity: High
Date: 2026-11-11
PV Inverter
Energy Storage System
EV Charger
Floating PV System
Wind Products
Hydrogen Equipment
Smart Energy Products
Description
The EYE-SV600 (EyeM4 logger) web management interface uses an HMAC-based request authentication mechanism. However, its signing key is inadequately secured. An
attacker who has network connectivity to the device may crack the key through technical approaches and forge valid request signatures, thereby bypassing authentication to access protected API functions.
Affected Versions
Vulnerable: All versions prior to EYE-SV600.002.00.P033B001.
Not Affected: EYE-SV600.002.00.P033B001 and later versions are not affected.
Vulnerability Rating
CVSS（4.0）：8.6/High/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
The scoring is based on the CVSS 4.0 standard. The scoring criteria can be referenced at (https://www.first.org/cvss/calculator/4.0)
Mitigation and Remediation
Recommended Action: The vulnerability was remediated on September 30, 2026. Affected customers are advised to upgrade their devices to EYE-SV600.002.00.P033B001 or later as soon as possible.
Patch Release: The fix is included in EYE-SV600.002.00.P033B001 and later versions.
Temporary Fix: N/A.
Acknowledgments
This vulnerability was discovered and reported by DIVD.
Contact information
For security issues regarding Sungrow products and solutions, please report to Sungrow psirt@sungrowpower.com.
Revision History
Version | Date | Description |
V1.0 | 2026-11-11 | Initial release |
Statement
All software updates, patches, and documentation provided by Sungrow Power Supply Co., Ltd. are the proprietary work of Sungrow. These materials may only be used for product maintenance and security improvements. Any unauthorized modification, distribution, decompilation, or reverse engineering is strictly prohibited.
Sungrow makes no express or implied warranties regarding the information provided, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement. Sungrow shall not be liable for any direct, indirect,
incidental, or consequential damages arising from the use of this document or
associated software.
Sungrow reserves the right to update or modify this document at any time without prior notice. Customers are responsible for implementing security updates in a timely manner to protect their systems.