One field set to five logged the researcher in as anyone, and the account owner was never told
2026-10-09Security
Sungrow's iSolarCloud accepted a login request with login_type set to 5 and authenticated whoever the request named, ignoring the password. All four regional clouds were affected, no notification was sent, and the researcher's own line about continent-wide blackouts has been quoted into the official CVE description.