Sungrow web portal full disclosure

19 Aug 2026 - Victor Pasman

DIVD received a vulnerability report from ENCS about the Sungrow web portal. The vulnerability was discovered by researcher Harm van den Brink.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVE to the vulnerability included in the write-up below:

The rest of this post contains the full technical write-up of the vulnerability.

MQTT endpoint and credentials used by the web portal can be used to obtain data of other Sungrow inverters (and potentially manipulate them) - CVE-2025-29756

The Sungrow web portal uses an underlying MQTT broker service to receive live updates of the status of the inverter. The web portal makes an API call to retrieve obfuscated/encrypted information about the MQTT broker’s endpoint from the Sungrow API and decrypts those credentials in JavaScript.

Via the JavaScript debugger it is possible to obtain the MQTT endpoint and credentials and subscribe to the topic(s) for the inverter(s) in the account.

The messages sent over MQTT are encrypted using asymmetrical encryption, but, again via JavaScript debugging, it is possible to obtain the RSA key that can be used for decryption (and potentially encryption) of MQTT messages.

This is all more or less expected, as it is impossible to implement an MQTT client in JavaScript in which this is not possible. However, the steps below should not be possible.

Using the MQTT credentials it is possible to subscribe to all topics, at which point the MQTT client starts receiving metadata about all other Sungrow inverters connected to the same MQTT broker. When we summed up the power production of 20 seconds of MQTT messages, we observed a total of over 400 MW of power.

We suspect that, by encrypting control messages with the same key and publishing them to these MQTT topics, it might also be possible to change settings on other inverters, but we have not verified this for fear of causing damage to or adverse effects on other inverters.

Suggested actions

Restrict access to the MQTT topics to only those that belong to the account, either by using a unique key pair for the devices in an account or by restricting rights on the MQTT broker.

Screenshot 1: MQTT credentials (secrets redacted)

MQTT credentials obtained via the JavaScript debugger (redacted)

Screenshot 2: obtaining keys (secrets redacted)

Obtaining the decryption material via JavaScript debugging (redacted)

Screenshot 3: obtaining keys (secrets redacted)

Obtaining the RSA public key via JavaScript debugging (redacted)

Last modified: 19 Aug 2026 08:52 CEST