Sungrow iSolarCloud releases prior to 2026-08-25 allow an authentication bypass when a login request includes "login_type":"5". This flaw enables attackers to take over user accounts even when only the user's email is known, and because the email for a user can be discovered from their parent organization, the scope of potential compromise is broad. The vulnerability, identified as CWE-288, could allow full control over the impacted cloud infrastructure and, as described, potentially lead to local blackouts across a continent in Europe.

The affected product is Sungrow iSolarCloud. Users of versions released before 2026 are impacted; specific version ranges are not listed, so all pre‑2026 builds should be reviewed.

The CVSS score is 9.2, indicating high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, so the current known exploitation probability is unclear. Based on the description, the attack likely proceeds remotely via the cloud API; an attacker would send a crafted login request containing "login_type":"5" to bypass authentication. No additional prerequisites beyond network access to the iSolarCloud service are mentioned, and the exploit could lead to local blackouts across a continent in Europe if the attacker gains broad control.