CVE-2026-107194

Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "logintype":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the useraccount property is required; however, a user can view the email addres...

CVE-2026-107194

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "logintype":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the useraccount property is required; however, a user can view the email...

EUVD-2026-94332

Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "logintype":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the useraccount property is required; however, a user can view the email addres...

CVE-2026-107194

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "logintype":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the useraccount property is required; however, a user can view the email...

CVE-2026-107194

The Sungrow iSolarCloud platform (versions before 2026) is vulnerable to an authentication bypass and account takeover . The root cause involves the processing of a login request where the parameter "login_type":"5" can be used to bypass security controls. While the system requires an email addre...

PT-2026-107513

Name of the Vulnerable Software and Affected Versions Sungrow iSolarCloud versions prior to 2026 Description An authentication bypass and account takeover issue exists when a login request is made using the login type parameter set to 5. This flaw could potentially lead to local blackouts across...

CVE-2026-107194: Authentication Bypass Using an Alternate Path or Channel

Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "logintype":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the useraccount property is required; however, a user can view the email addres...

EUVD-2025-5291

Malicious code in bioql PyPI...

EUVD-2025-5289

Malicious code in bioql PyPI...

EUVD-2025-5284

Malicious code in bioql PyPI...

EUVD-2025-5285

Malicious code in bioql PyPI...

EUVD-2025-5290

Malicious code in bioql PyPI...

EUVD-2025-5283

Malicious code in bioql PyPI...

EUVD-2025-5288

Malicious code in bioql PyPI...

CVE-2025-29756

The CVE-2025-29756 entry describes a vulnerability in SunGrow iSolarCloud’s MQTT service used by the backend for device data transport. The MQTT broker reportedly lacks sufficient topic-subscription restrictions, enabling a user with an iSolarCloud account to subscribe to any topic (notably the a...

CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While...

CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While...

Sungrow iSolarCloud security vulnerabilities

Sungrow iSolarCloud Sunshine Cloud is a software for monitoring and managing PV power plants from China's Sunny Power Sungrow. A security vulnerability exists in Sungrow iSolarCloud, which stems from an under-restricted MQTT service that could result in subscribing to arbitrary topics and...

PT-2025-25185 · Sungrow · Isolarcloud

Name of the Vulnerable Software and Affected Versions: SunGrow's back end users system iSolarCloud affected versions not specified Description: The issue concerns the MQTT service used by iSolarCloud to transport data from connected devices to the user's web browser. The MQTT server lacks...

CISA Releases Thirteen Industrial Control Systems Advisories

CISA released thirteen Industrial Control Systems ICS advisories on March 13, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-072-01 Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation...