Sungrow iSolarCloud Insecure Direct Object Reference Vulnerability in orgService API

A vulnerability allowing Insecure Direct Object References (IDOR) has been identified in the Sungrow iSolarCloud orgService API, prior to the October 31, 2024 remediation. This vulnerability allows attackers to access and modify organizational data without proper authentication, potentially leading to unauthorized changes in organization-wide settings, exposure of sensitive business information, and disruption of services.

Impact

Exploitation of this vulnerability could result in unauthorized access to and modification of organizational data, allowing for unauthorized changes to organization-wide settings, exposure of sensitive business data, and disruption of services.

Remediation

Sungrow iSolarCloud has been upgraded and repaired on October 31, 2024, without requiring customer action.