Internet-Based Solar Panel Systems Vulnerable to Rapid Cyberattacks

The expansion of solar energy infrastructure has introduced significant cybersecurity challenges. With the widespread adoption of renewable power sources, vulnerabilities have emerged due to reliance on outdated industrial protocols.

Technical Vulnerabilities in Solar Systems

Security researchers have identified critical flaws in solar systems, particularly those using legacy industrial protocols lacking basic security measures. These vulnerabilities allow attackers to remotely shut down power generation. Cato Networks' CTRL and MDR teams have detected attempts to exploit Modbus devices embedded in solar string monitoring boxes. These monitoring boxes control panel output and are susceptible to unauthorized access.

Threat actors can utilize internet connections and readily available tools to disable power generation. This capability has transformed the renewable energy sector into a potential cyber battlefield, with the ability to execute attacks in minutes using automated tools.

Solar farms operate through a structured infrastructure where photovoltaic modules generate electricity, organized into strings connected to string monitoring boxes. These boxes communicate with SCADA systems, which manage operations and enable control commands.

The primary vulnerability resides in the monitoring boxes, which use the Modbus protocol, developed over 50 years ago. Modbus lacks authentication and encryption, allowing unauthorized access via port 502. Public tools initially designed for engineering purposes can now facilitate malicious reconnaissance and exploitation.

Nmap scripts such as modbus-discover and modbus-read can identify exposed devices and manipulate registers. Command-line utilities like mbtget and mbpoll allow register manipulation. The Metasploit framework enables rapid scanning of devices, while AI-powered frameworks like HexStrike AI can autonomously orchestrate these tools, significantly reducing attack execution time.

Exploiting these vulnerabilities can lead to substantial operational disruptions, including damaged equipment, fire hazards, and grid instability. The U.S. Cybersecurity and Infrastructure Security Agency advises segmenting networks, avoiding direct internet exposure of devices, and implementing continuous monitoring.

Security platforms that provide port exposure alerts, real-time event monitoring, and network microsegmentation are essential for mitigating these threats and ensuring the secure integration of solar energy systems into the global energy framework.

Based on reporting by GBHackers.