Cybersecurity researchers have discovered a series of security flaws in photovoltaic system management platforms operated by Chinese companies Solarman and Deye that could allow attackers to cause failures and power outages.
“If exploited, these vulnerabilities could allow an attacker to control inverter settings that could disable part of the network, potentially causing outages,” Bitdefender researchers said. said in an analysis published last week.
The vulnerabilities were patched by Solarman and Deye as of July 2024 following a responsible disclosure on May 22, 2024.
A Romanian cybersecurity vendor that analyzed two PV monitoring and management platforms said they suffer from a number of issues that could lead to account hijacking and information disclosure, among other things.
A brief description of the issues is given below –
- Complete account capture via authorization token manipulation using the /oauth2-s/oauth/token API endpoint
- Reusing Deye Cloud Token
- Information leak via /group-s/acc/orgs API Endpoint
- A hard-coded account with unlimited access to the device (Account: “SmartConfigurator@solarmanpv.com” / Password: 123456)
- Information leak via /user-s/acc/orgs API Endpoint
- Potential unauthorized generation of authorization tokens
Successful exploitation of the above vulnerabilities could allow attackers to gain control of any Solarman account, reuse JSON Web Tokens (JWT) from Deye Cloud to gain unauthorized access to Solarman accounts, and collect private information about all registered organizations.
They could also obtain information about any Deye device, access sensitive registered user data, and even create authentication tokens for any user on the platform, seriously compromising privacy and integrity.
“Attackers can take over accounts and control solar inverters, disrupting power generation and potentially causing voltage fluctuations,” the researchers said.
“Confidential information about users and organizations can be leaked, leading to privacy breaches, information harvesting, targeted phishing attacks, or other malicious activities. By accessing and changing the settings of solar inverters, attackers can cause widespread disruptions in power distribution, affecting grid stability and potentially leading to blackouts.”
