Reception

Sungrow continuously identifies potential vulnerabilities through multiple channels, including reports from security researchers, customers, partners, and suppliers, as well as proactive threat intelligence detection.
● Dedicated security email:psirt@sungrowpower.com
● Official PSIRT Portal:https://cn.sungrowpower.com/en/security-incident-response
● Dedicated reporting channel
● Proactive threat intelligence monitoring

Assessment

● Validation:Verify the authenticity and reproducibility of the reported vulnerability
● Impact Analysis: Assess affected products, versions, and customer impact
● Risk Rating:Evaluate severity using CVSS methodology
● Prioritization:Determine remediation priority and response plan

Remediation

● Develop remediation plans
● Provide temporary mitigation measures when applicable
● Develop and test security patches
● Validate remediation effectiveness
● Prepare customer deployment guidance

Disclosure

Transparent Communication Framework
● Maintain continuous communication with vulnerability submitters and provide regular progress updates throughout remediation.
● Issue timely security advisories to all affected customers.
● Support customers with remediation planning and relevant technical assistance.
● Execute coordinated public disclosure after patches and fixes are fully ready.
Coordinated Disclosure Principles
● Vulnerability details will not be publicly disclosed until remediation is available.
● Disclosure timing is coordinated with the reporting party.
● Customers are provided with sufficient time to deploy mitigations and updates.

Improvement

Sungrow conducts regular vulnerability reviews and improvement initiatives, carrying out technical and procedural reviews to identify root causes and define corrective actions. Lessons learned from these activities are incorporated into our secure development processes, product security controls and vulnerability response framework, enabling continuous enhancement of our security defense capabilities.

Vulnerability Disclosure Policy

Overview

Sungrow is committed to maintaining the security of its products, services, and customers. We welcome security researchers, customers, partners, and other stakeholders to responsibly report potential security vulnerabilities that may affect Sungrow products, systems, or services.

For reporting channels, PGP encryption details, required report content, and Sungrow's response commitments, please refer to the Report a Vulnerability tab.

Scope

This policy applies to all of Sungrow's products.

How to Report a Vulnerability

For reporting channels, PGP encryption details, required report content, and Sungrow's response commitments, please refer to the Report a Vulnerability tab.

Coordinated Vulnerability Disclosure

Sungrow handles vulnerability disclosure in accordance with Coordinated Vulnerability Disclosure principles.

Confidentiality

Sungrow will treat non-public vulnerability information as confidential and restrict access to individuals and organizations that reasonably require the information for vulnerability analysis, remediation, coordination, customer protection, or compliance purposes.

Where necessary, vulnerability information may be shared with relevant Sungrow affiliates, suppliers, technology partners, affected customers, CSIRTs, competent authorities, or other parties involved in remediation or where disclosure is required by applicable law.

Where reasonably possible, Sungrow will seek to ensure that parties receiving non-public vulnerability information apply appropriate confidentiality protections.

Reporters are requested to keep non-public vulnerability details confidential while Sungrow investigates and remediates the issue and while a coordinated disclosure timeline is being established.

Disclosure Coordination

Once a vulnerability has been validated, Sungrow PSIRT will work with the reporter in good faith to coordinate an appropriate public disclosure timeline.

The disclosure timeline may take into account factors including:

Severity and exploitability of the vulnerability

Availability and deployment of mitigations or patches

Customer safety and operational impact

Product and supply-chain dependencies

Time reasonably required for affected customers to implement remediation

Applicable legal and regulatory obligations

Reporters are requested not to publicly disclose detailed technical information, Proof-of-Concept code, exploit code, or other information that could materially increase risk to customers before the coordinated disclosure date.

Sungrow will seek to avoid unnecessary delays in coordinated disclosure and will communicate with the reporter if additional remediation time is reasonably required.

Once disclosure has been coordinated, the reporter and Sungrow may agree on appropriate publication methods, including security advisories, vulnerability databases, technical publications, or conference presentations.

Nothing in this Policy is intended to prevent disclosures required by applicable law.

Safe Harbor

Sungrow appreciates and supports good-faith, responsible security research activities.

For individuals conducting security research in good faith and complying with this Policy, Sungrow commits that it will not initiate lawsuits or take legal action against them, provided all of the following conditions for the research activities are met:

Reproduce vulnerabilities only through verification with minimal impact; do not tamper with, delete or steal business data or device configurations. Immediately terminate testing and submit a report upon accessing any sensitive data.

Do not cause service disruption to customers, partners or Sungrow.

Do not launch Denial-of-Service (DoS) attacks.

Do not leverage vulnerabilities for lateral movement, persistent control or further exploitation attacks.

Do not profit from vulnerabilities, engage in extortion, or trade vulnerability information.

Do not violate any applicable laws and regulations.

Do not publicly disclose vulnerability details before the corresponding patch is fully released.

Sungrow reserves the right to take appropriate measures if any research activity falls outside the scope specified above.

Personal Safety Tips

Some Sungrow products involve high-voltage power equipment, which carries safety risks such as electric shock and arc flash. Researchers should conduct testing in a safe environment, comply with electrical work safety regulations, and wear appropriate personal protective equipment where necessary.

Acknowledgements And Recognition

Sungrow appreciates the valuable contributions of the security research community.

For valid and responsibly reported vulnerabilities, Sungrow may acknowledge the reporter's contribution. With the reporter's consent, recognition may be provided through security advisories, acknowledgments, or other appropriate channels.

Currently, Sungrow does not operate a public bug bounty program. Should such a program be introduced in the future, detailed information will be published on the official website.

Contact

For questions regarding this VDP or other product security matters, please contact Sungrow PSIRT: psirt@sungrow-emea.com

Policy Version: 1.0
Last Updated: 20.09.2026