Skip to main content

Millions of solar power systems could be at risk of cyber attacks after researchers find flurry of vulnerabilities

Web Hosting & Remote IT Support
  • Insecure solar systems allow cybercriminals to steal data and ransom access
  • Millions of solar inverters remain vulnerable to severe cybersecurity threats
  • Forescout – Vedere uncover flaws allowing attackers to take full control over solar systems

The increasing use of solar power has exposed critical cybersecurity vulnerabilities in inverters, cloud computing services, and monitoring platforms, creating an insecure ecosystem where hackers can manipulate energy production, disrupt power grids, and steal sensitive data, posing serious risks to global energy infrastructure, experts have warned.

A study by Forescout – Vedere Labs identified 46 new vulnerabilities across three major solar inverter manufacturers, including Sungrow, Growatt, and SMA. Previous findings showed that 80% of reported vulnerabilities were high or critical in severity, with some reaching the highest CVSS scores.

Over the past three years, an average of 10 new vulnerabilities have been disclosed annually, with 32% carrying a CVSS score of 9.8 or 10, indicating that attackers could fully compromise affected systems.

Millions of solar power systems face security risks

Many solar inverters connect directly to the internet, making them easy targets for cybercriminals. Attackers can exploit outdated firmware, weak authentication mechanisms, and unencrypted data transmissions to gain control.

Exposed APIs allow hackers to enumerate user accounts, reset credentials (ideally stored in password managers) to default values, and manipulate inverter settings, leading to power disruptions.

Additionally, insecure object references and cross-site scripting (XSS) vulnerabilities could expose user emails, physical addresses, and energy consumption data, violating privacy regulations such as GDPR.

Beyond grid instability, compromised inverters create further risks, including data theft, financial manipulation, and smart home hijacking - some vulnerabilities allow attackers to take control of electric vehicle chargers and smart plugs.

Cybercriminals could also alter inverter settings to influence energy prices or demand ransom payments to restore system functionality. As a result, the report recommends that manufacturers should prioritize patches, adopt secure coding practices, and conduct regular penetration testing.

Implementing Web Application Firewalls (WAFs) and adhering to cybersecurity frameworks like NIST IR 8259 could help mitigate risks.

Regulators are also urged to classify solar inverters as critical infrastructure and enforce security standards such as ETSI EN 303 645 to ensure compliance with best practices.

For solar system owners and operators, securing installations requires isolating solar devices on separate networks, enabling security monitoring, and following guidelines from organizations like the U.S. Department of Energy to reduce risks.

Installing the best antivirus software adds an extra layer of defense against threats, while deploying the best endpoint protection solutions further safeguards connected devices from cyberattacks targeting solar infrastructure.

You may also like



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

These mobile games are just trying to steal your crypto hoard, FBI warns

Web Hosting & Remote IT Support The FBI has warned consumers about a newly-detected, fake "play-to-earn" mobile and online game that tricks victims into depositing cryptocurrency, only to later steal it.  In a public service announcement , the FBI said the elaborate scheme sees scammers first contact the potential victim and try to build a relationship with them.  After a little back-and-forth, the scammers would invite the victim to play an online or mobile game, in which players purportedly earn cryptocurrency rewards in exchange for some activity, “such as growing ‘crops’ on an animated farm” the FBI said.  Depositing cryptos But getting into the “game” isn’t free - the victims must first create a cryptocurrency wallet and deposit some money, which is where the real scam begins. The fraudsters would later also tell the victims that the more funds they deposit, the higher the gains will be. However, as soon as the victim stops depositing additional funds, the...
Post a Comment
Read more

Want a remote control for your smart home? SwitchBot has made a Matter-compatible one

Web Hosting & Remote IT Support SwitchBot has launched a unique piece of tech capable of controlling smart home devices and infrared appliances. And the best part is you don’t need to connect it to a smartphone or to the internet as it functions perfectly offline.  Aptly named the SwitchBot Universal Remote , it has large spacious buttons, a navigation wheel in the middle, and a 2.4-inch LCD at the top. The company states in their announcement it sought to create a “user-friendly design” that everybody can understand. Now, you can’t just point the Universal Remote at a device and then push a button to issue commands immediately. According to Android Central , you must first choose what you want to control, which can be done by pressing the center red button. Pressing the main button will let you change which group of smart home devices to control.  Universal Remote has launched! 🚀 Consolidate all your remotes, and control everything at home, even #automation! NOW,...
Post a Comment
Read more