Sungrow iSolarCloud vulnerabilities

Latest Sungrow iSolarCloud CVEs

Newest publication first

1. CVE-2026-107194 Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Euro...

   Published 2026-10-07

   Critical·CVSS 9.2 EPSS 0.45%

   Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user...

2. CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

   Published 2025-06-11

   High·CVSS 8.3 EPSS 0.27%

   SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subs...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.