【Security Advisory】Login bypass vulnerability in Sungrow iSolarCloud (SGSA-202608-0028)

Publish Date: 20261010

Advisory ID: SGSA-202608-0028

Product:  iSolarCloud

CVE ID: CVE-2026-107194

Severity: Critical

Date: 2026-10-10

Description

Following a technical assessment, an authentication bypass vulnerability was identified in the iSolarCloud platform.

An attacker with prior knowledge of a target user's valid email address could select the "Email + Password" login option and manipulate specific login request parameters to bypass the authentication process.

This vulnerability could allow an attacker to gain access to the platform with the privileges of the affected user account without successfully completing authentication. Once logged in, the attacker could view the list of devices associated with the account, their operational status, and historical monitoring data.

Affected Versions

Vulnerable: The vulnerability was fully remediated on August 25, 2026; the system before this date carried this security exposure.

Not Affected: Following the remediation deployment on August 25, 2026, the system is no longer vulnerable to this flaw.

Vulnerability Rating

CVSS（4.0）：9.2/critical/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:P

The scoring is based on the CVSS 4.0 standard. The scoring criteria can be referenced at (https://www.first.org/cvss/calculator/4.0)

Mitigation and Remediation

Recommended Action: iSolarCloud was upgraded and remediated on 25 August 2026. No upgrade action is required from customers.

Patch Release: N/A.

Temporary Fix: N/A.

Acknowledgments

This vulnerability was discovered and reported by Marlon Starkloff.

Contact information

For security issues regarding Sungrow products and solutions, please report to Sungrow psirt@sungrowpower.com.

Revision History

Statement

All software updates, patches, and documentation provided by Sungrow Power Supply Co., Ltd. are the proprietary work of Sungrow. These materials may only be used for product maintenance and security improvements. Any unauthorized modification, distribution, decompilation, or reverse engineering is strictly prohibited.

Sungrow makes no express or implied warranties regarding the information provided, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement. Sungrow shall not be liable for any direct, indirect, incidental, or consequential damages arising from the use of this document or associated software.

Sungrow reserves the right to update or modify this document at any time without prior notice. Customers are responsible for implementing security updates in a timely manner to protect their systems.