Sungrow iSolarCloud releases prior to 2026 permit an authentication bypass when a login request specifies "login_type":"5". This flaw enables attackers to take over user accounts even when only the user's email is known, and because the email for a user can be discovered from their parent organization, the scope of potential compromise is broad. The vulnerability is identified as CWE‑288 and could allow full control over the impacted cloud infrastructure, creating the theoretical risk of widespread grid outages as described by the vendor.

The affected product is Sungrow iSolarCloud, which is deployed in commercial and industrial solar installations. Users of versions released before 2026 are impacted; specific version ranges are not listed, so all pre‑2026 builds should be reviewed.

The CVSS score is 9.2, indicating high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so the current known exploitation probability is unclear. Based on the description, the attack likely proceeds remotely via the cloud API; an attacker would send a crafted login request containing "login_type":"5" to bypass authentication. No additional prerequisites beyond network access to the iSolarCloud service are mentioned, so the threat applies to any connected device or administrator with normal credentials.