93 Security Flaws Found in the Solar Inverters Powering UK Homes

Where does “93 security flaws” come from?

Let’s start with the number itself, because it’s been bouncing around the internet like a ping-pong ball. It comes from a piece of cybersecurity research called SUN:DOWN, published by Forescout’s Vedere Labs in March 2025. The researchers did two things: they counted every previously disclosed vulnerability ever published for solar power equipment — that’s the 93 — and then they went looking for new ones themselves.

Their own hunt turned up 46 brand-new vulnerabilities across three big manufacturers: Sungrow, Growatt and SMA — brands you’ll absolutely find on thousands of UK roofs. Around 80% of the 93 known flaws were rated high or critical severity, and roughly a third carried the highest possible danger scores, meaning a successful attacker could take full control of an affected system.

Here’s the part the scary headlines tend to skip: the inverter itself is mostly not the problem. Look at where the flaws actually sit:

That’s right — your phone app and the manufacturer’s cloud are the weak links far more often than the hardware. If you want a plain-English rundown of how these monitoring setups differ, our guide to solar panel monitoring systems in the UK is worth a read, and our pick of the best solar monitoring apps for 2026 covers which ones take security seriously.

What could a hacker actually do with your inverter?

Let’s be honest about the worst case, because it’s genuinely interesting. The researchers showed that someone who controls a fleet of inverters could switch them off and on in a coordinated way, like a botnet. Thousands of systems dropping at once would, in theory, wobble the grid — which is why national security types pay attention to this research.

But for you, personally, on your semi in Leeds? The realistic picture is much calmer:

Remember, the UK’s grid is operated with serious cyber defences, and one household’s 4kW system is a rounding error. The NCSC’s own guidance on smart devices in the home treats kit like this the same way it treats a smart doorbell: sensible hygiene beats panic. And if your inverter shares Wi-Fi with everything else, our piece on whether solar interferes with Wi-Fi and TV has useful setup tips too.

Solar inverter security: a quick timeline

Is your inverter brand affected?

The researchers analysed six of the world’s top ten solar vendors: Huawei, Sungrow, Ginlong Solis, Growatt, GoodWe and SMA. The new flaws landed in three of them. Here’s the honest scorecard for UK homes:

If you’re among the many UK households with a Huawei unit, we’ve covered exactly what the UK withdrawal means for you in our Huawei SUN2000 inverter review — short version: your warranty and the FusionSolar app carry on as normal. And if you’re comparing inverter types for a new system, our micro inverter vs string inverter guide explains the options in plain English.

The UK angle: 2 million roofs and counting

This story lands differently in Britain than elsewhere. Europe already accounts for around three-quarters of all internet-exposed solar devices on the planet, and the UK is one of Europe’s biggest domestic solar markets — government figures show we passed 2 million solar installations and 22.3 GW of capacity in early 2026, with the government’s Warm Homes Plan aiming to put panels on up to 3 million more homes by 2030.

The good news is that the UK is not standing still on gadget security. The Product Security and Telecommunications Infrastructure (PSTI) Act has been in force since April 2024, banning universal factory-default passwords in consumer connectable products sold here, and the ETSI EN 303 645 standard gives manufacturers a proper security baseline to build against. The direction of travel is clear: connected solar kit sold in the UK must be secure by design, and the lazy default passwords of the past are being legislated out of existence.

The 10-minute solar inverter lockdown

Everything below is free, needs no technical degree, and addresses practically every weakness the SUN:DOWN research highlighted. Make a cuppa first — you’ll still finish before it goes cold.

1. 3 minUpdate everything. Inverter firmware, monitoring app, phone app store version. The 46 new flaws were patched by vendors — but a patch only works once installed.
2. 2 minKill the default password. If your monitoring login is still admin/admin or a sticker code, change it to a unique, boring, long password. This single habit blocks the laziest attacks.
3. 1 minSwitch on two-factor authentication (2FA) in your monitoring app if offered. It turns a stolen password into a useless piece of text.
4. 2 minCheck the router. Log in and make sure no port forwarding points at your inverter or data logger. Vendors themselves say these devices should never sit naked on the public internet.
5. 2 minGuest-network it. Pop the inverter on your router’s guest Wi-Fi so it can phone home but can’t chat to your laptop, camera or smart doorbell.

Then make firmware checks part of your yearly routine — we’ve built a full solar panel maintenance checklist that slots this in nicely, and your warranty generally expects you to keep software current anyway. Buying new? An MCS-certified installer will set the system up securely from day one and talk you through the app properly.