Investigators Unearth Weaknesses in Solarman and Deye Solar Systems
Security experts have uncovered various weaknesses in photovoltaic system management platforms operated by Chinese enterprises Solarman and Deye that could empower nefarious individuals to induce disturbances and electricity outages.
“Should these vulnerabilities be exploited, an attacker could manipulate inverter settings to cause disruptions in the grid, potentially leading to blackouts,” pointed out Bitdefender researchers in a report released last week.
The vulnerabilities have been resolved by Solarman and Deye in July 2024, subsequent to responsible disclosure on May 22, 2024.
The cybersecurity provider from Romania, which scrutinized the two PV monitoring and management platforms, revealed a variety of concerns that might result in unauthorized account access and disclosure of information.
A succinct overview of the issues is outlined below –
- Complete Account Takeover through Manipulation of Authorization Token Using the /oauth2-s/oauth/token API endpoint
- Reuse of Deye Cloud Token
- Exposure of Information via /group-s/acc/org API Endpoint
- Pre-set Account with Unrestricted Device Access (account: “SmartConfigurator@solarmanpv.com” / password: 123456)
- Leakage of Information through /user-s/acc/org API Endpoint
- Possible Unauthorized Generation of Authorization Token
Successful exploitation of these vulnerabilities could give attackers control over any Solarman account, reuse JWTs from Deye Cloud to gain unauthorized access to Solarman accounts, and access confidential information about all registered organizations.
They could also retrieve details about any Deye device, access confidential data of registered users, and even create authentication tokens for any user on the platform, significantly compromising its secrecy and reliability.
“Malicious actors can commandeer accounts and manipulate solar inverters, disrupting power generation and potentially causing voltage fluctuations,” explained the researchers.
“Sensitive data about users and organizations may be exposed, leading to privacy breaches, data collection, targeted phishing attacks or other malicious operations. By tampering with settings on solar inverters, attackers could trigger widespread disruptions in electricity distribution, affecting grid stability and possibly resulting in blackouts.”
About Author
