Solar Power Infrastructure Vulnerable to Hacking

Researchers detected security shortcomings in the world’s leading solar inverters that could enable hackers to hijack solar energy production and destabilize power grids.

See Also: Future-Proof Your Business: A Comprehensive Guide to Application Modernization and Development for Public and Private Sectors

Analysis by Forescout’s Vedere Labs of solar power devices connected to its cloud platform found security gaps in inverters made by Sungrow, Growatt and SMA, which collectively account for roughly a third of the globalmarket share of photovoltaic inverters – equipment that converts the direct electrical current of solar panels into the alternating frequency transmitted by commercial grids.

Vulnerabilities include unauthorized remote access, insecure authentication mechanisms and remote code execution. “We can hypothesize that an attacker that gained control of a large fleet of Sungrow, Growatt and SMA inverters using the newly discovered vulnerabilities could control enough power to cause instability” in the power grids they interface with, wrote researchers.

Attackers could seize control of inverters to switching them on or off, an attack that would be easier to execute on Growatt inverters since its cloud backend provides access to the inverter’s configuration settings. With enough inverters under attackers’ control, they could tune the inverters to a resonance rate leading to frequency swings greater than the safety range, potentially even causing a grid shutdown.

Some Sungrow inverters have insecure direct object reference vulnerabilities in their application programing interfaces, potentially allowing attackers to access firmware files. Researchers found they could obtain remote command execution on customer accounts by changing the file extension of malware, since the cloud back end didn’t properly sanitize inputs.

Cyberattacks capable of disrupting power grids leapt from conjecture to reality after Russian intelligence agency hackers in 2015 triggered a power outage in Ukraine, plunging hundreds of thousands of customers into darkness during winter. Russia has continued to attack the energy infrastructure of its European neighbor, provoking concerns in the United States its grid is susceptible to attack by nation state hackers.

More than half of solar inverter manufacturers and 58% of energy storage system vendors are based in China, Forescout analysis found (see: Chinese Hackers Preparing ‘Destructive Attacks,’ CISA Warns).

In 2024, the FBI published a warning that renewable energy will likely attract more cyberattacks as its production share goes up. Hackers have already penetrated connected solar monitoring technology, although disrupting power generation doesn’t appear to have been their goal, so far.

Researchers have discovered a steady stream of vulnerabilities in solar power equipment, most of them high or critical in severity. A third of vulnerabilities assigned a CVE tracking number since 2012 have a score of 9.8 or 10, “which usually indicates that an attacker can take full control of an affected system,” Forescout wrote.

The Forescout report highlights multiple vulnerabilities posing risks to grid stability and security. Below are the five most critical vulnerabilities:

• CVE-2022-29303 in Contec SolarView: This vulnerability aids remote code execution, enabling attackers to take full control of the affected system. Exploitation could lead to manipulation of power flow, potentially disrupting grid stability.
• CVE-2022-40881 in Contec SolarView: A privilege escalation flaw that enables attackers to gain administrative access, helping unauthorized modifications to system settings, leading to power disruptions.
• CVE-2023-23333 in Contec SolarView: A severe authentication bypass vulnerability that lets attackers execute commands on the system without proper credentials. This flaw increases the risk of system takeover and operational sabotage.
• CVE-2023-28343 in APsystems Altenergy: This vulnerability affects cloud-based solar energy management platforms, facilitating attackers to manipulate power distribution remotely. Such exploits could lead to large-scale energy outages.
• CVE-2024-11305 in APsystems Altenergy: A critical command injection flaw that permits arbitrary code execution, enabling attackers to override security controls and gain persistent access to the system.