CVE-2026-107194: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Sungrow iSolarCloud

Sungrow iSolarCloud before 2026 contains an authentication bypass vulnerability (CWE-288) that can be triggered by sending a login request with the parameter "login_type":"5". This bypass allows attackers to take over user accounts without proper credentials. The vulnerability requires the user_account property to be an email address, which can be viewed by users within their parent organization. The flaw has a CVSS 4.0 score of 9.2, indicating critical severity with network attack vector, low attack complexity, no user interaction, and partial privileges required. The vulnerability could lead to significant operational disruptions such as local blackouts in Europe.

Successful exploitation of this vulnerability allows attackers to bypass authentication and take over user accounts in the iSolarCloud platform. This could lead to unauthorized control over solar energy management systems, potentially causing local blackouts on the European continent. The exposure of email addresses linked to parent organizations may facilitate targeted attacks or social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and apply any official patches once available. Until then, restrict access to the affected systems and monitor for suspicious login attempts involving the "login_type":"5" parameter.