Sungrow iSolarCloud Insecure Direct Object Reference Vulnerability in devService API

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the Sungrow iSolarCloud devService API, prior to the October 31, 2024 remediation. This vulnerability enables unauthorized access to device-related data, potentially exposing sensitive information about Sungrow devices and their operational parameters.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive device-related data, including operational parameters of Sungrow devices.

Remediation

Sungrow iSolarCloud has been upgraded and repaired on October 31, 2024, without requiring customer action.