Global solar power industry under threat
The rise in the use of solar power worldwide has revealed gaps in cybersecurity in cloud computing devices, inverters, and monitoring platforms. As these become prone to critical vulnerabilities, it creates an unsafe ecosystem where threat actors can disrupt power grids, exploit energy production, and steal important data, causing serious threats to global energy infrastructures.
A recent study has found 46 new flaws across three main solar inverter manufacturers- SMA, Growatt, and Sungrow. Past findings revealed that 80% of documented flaws were high or critical, with a few touching the highest CVSS scores. In the last three years, an average of 10 new flaws have been reported annually; 32% of these carried a CVSS score of 9.8 or 10, suggesting that threat actors could exploit compromised systems fully.
Experts at Forescout research said their findings have shown an “ecosystem that is insecure — with dangerous energy and national security implications.” “While each residential solar system produces limited power, their combined output reaches dozens of gigawatts” This makes their “collective impact on cybersecurity and grid reliability too significant to ignore.”
Solar power systems are in danger, and millions of them
Various solar investors link with the internet directly. This makes them scapegoats for attackers, as they can exploit out-of-date firmware, unencrypted data transmissions, and poor authentication mechanisms to take control.
How threat exploit grid infrastructure
Hackers use exposed APIs to hack user accounts, change credentials, and change inverter settings, causing power outages. Also, unsafe object references and cross-site scripting (XSS) flaws could disclose user emails, energy consumption data, and physical addresses, breaking privacy regulations like GDPR. “Attacks can target individual persons and organizations owning solar power systems, or they can be broad and automated,” Forescout said.
Risks posed by solar power
Apart from grid instability, compromised inverters can also cause further risks such as financial manipulation, smart home hijacking, and data theft. A few flaws let hackers take control of EV chargers and smart plugs. By changing inverter settings, attackers can impact energy prices and demand ransom payments to restore system functions.
Robust cybersecurity frameworks such as NIST IR 8259 and the implementation of Web Application Firewalls (WAFs) can help lower threats.