Isolarcloud
Approved changes feed: RSS · Atom
cpe:2.3:a:sungrow:isolarcloud:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Sungrow (367570a5-27e0-5185-bb59-d1fc653e448d) |
|---|---|
| Product | Isolarcloud (32b76f83-92da-5687-bbf8-d221964dac9d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-107194 |
vulnerable | 2026-11-03 10:15:59.438730 |
Details available
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
Published: 2026-10-07T13:54:45.211Z
Updated: 2026-10-19T14:03:48.206Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29756 |
vulnerable | 2026-06-08 07:14:56.558569 |
MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters
SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser.
The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to.
While the data that is transmitted through the MQTT server is encrypted and the credentials for the MQTT server are obtained though an API call, the credentials could be used to subscribe to any topic and the encryption key can be used to decrypt all messages received.
An attack with an account on iSolarCloud.com could extract MQTT credentials and the decryption key from the browser and then use an external program to subscribe to the topic '#' and thus recieve all messages from all connected devices.
Published: 2025-06-11T08:01:16.794Z
Updated: 2025-06-23T12:45:06.342Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.