Scientists Discover Weaknesses in Solarman and Deye Solar Systems
Researchers in cybersecurity have detected several vulnerabilities in solar power system management platforms operated by Chinese companies Solarman and Deye that could facilitate disruptive actions resulting in power failures.
An analysis published last week by Bitdefender researchers stated that if these vulnerabilities were exploited, they could potentially enable an attacker to manipulate inverter configurations that might lead to power grid disruptions, potentially triggering blackouts.
The security flaws have been rectified by Solarman and Deye as of July 2024, subsequent to responsible disclosure on May 22, 2024.
The cybersecurity company from Romania, which conducted an evaluation of the two photovoltaic monitoring and management platforms, indicated that the platforms have multiple vulnerabilities such as those that could result in unauthorized access to accounts and data disclosure.
Here are some of the issues outlined briefly:
- Unauthorized Control of Accounts via Manipulation of Authorization Tokens using the /oauth2-s/oauth/token API endpoint
- Reuse of Deye Cloud Tokens
- Disclosure of Information through /group-s/acc/orgs API Endpoint
- Inclusion of Default Account with Unrestricted Device Access (account: “SmartConfigurator@solarmanpv.com” / password: 123456)
- Information Disclosure via /user-s/acc/orgs API Endpoint
- Possible Generation of Unauthorized Authorization Tokens
If these vulnerabilities were successfully exploited, attackers could potentially take control of any Solarman account, reuse JSON Web Tokens (JWTs) from Deye Cloud to gain unauthorized entry to Solarman accounts, and access sensitive information about all registered organizations.
They could also retrieve data about any Deye device, access confidential information of registered users, and even generate authentication tokens for any user on the system, greatly compromising its confidentiality and integrity.
The researchers cautioned that, “Attackers have the potential to hijack accounts and manipulate solar inverters, disrupting power generation and potentially causing fluctuations in voltage.”
“Sensitive data about users and organizations could be exposed, leading to privacy breaches, data mining, targeted phishing attacks, or other malicious activities. By accessing and altering settings on solar inverters, assailants could disrupt power distribution on a large scale, affecting grid stability and potentially leading to blackouts.”
About Author
