Sungrowpower manufactures solar-energy inverters and monitoring platforms including iSolarCloud and the WiNet-S gateway product, which sit at critical control and visibility points in distributed renewable-energy infrastructure. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur through weakness classes including authorization bypass, hard-coded credentials, and buffer overflows that are characteristic of embedded network devices with legacy security postures. Defenders managing solar and microgrid deployments should prioritize inventory and patching of these products; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sungrowpower over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-50688CRITICAL SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT | Feb 26, 2025 | 9.8 | 29 | NO | NO |
CVE-2024-50695CRITICAL SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds checks. | Jan 24, 2025 | 9.8 | 29 | NO | NO |
CVE-2024-50693CRITICAL SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model. | Feb 26, 2025 | 9.1 | 28 | NO | NO |
CVE-2024-50689CRITICAL SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API model. | Feb 26, 2025 | 9.1 | 28 | NO | NO |
CVE-2024-50687CRITICAL SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model. | Feb 26, 2025 | 9.1 | 28 | NO | NO |
CVE-2024-50694CRITICAL In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is u | Jan 24, 2025 | 9.8 | 27 | NO | NO |
CVE-2024-50698CRITICAL SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content. | Jan 24, 2025 | 9.8 | 26 | NO | NO |
CVE-2024-50691HIGH SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM a | Feb 26, 2025 | 7.4 | 24 | NO | NO |
CVE-2024-50686CRITICAL SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService API model. | Feb 26, 2025 | 9.1 | 24 | NO | NO |
CVE-2024-50685CRITICAL SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService API model. | Feb 26, 2025 | 9.1 | 24 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sungrowpower.
Media articles that mention a CVE ID that affects a product developed by Sungrowpower — matched by CVE ID, not by vendor name.