Nearly 2,000 Hungarian solar power devices are exposed on the internet

At least 1,916 Hungarian devices associated with photovoltaic power generation, i.e., solar panel equipment, are freely accessible via the open internet, and many of these accessible interfaces are riddled with vulnerabilities, according to cybersecurity expert Tamás Kocsis, author of Kiberblog, who assessed the exposure of domestic solar power systems. He detailed the results of his research in a longer study, but also summarized the key findings in a blog post.

“Solar energy generation already accounts for half of domestic electricity production. The generating equipment typically comes from a few large manufacturers, the majority of which are Chinese. This technology concentration, along with cybersecurity risks and vulnerabilities, as well as the technological architecture (and its shortcomings) as observed, constitutes a problem that requires a solution,” the expert summarized the lessons learned.

Kocsis began investigating domestic solar power systems after the Dutch cybersecurity firm Modat published research on the topic in early October, which “found that 8,500 EU solar and wind energy generation devices (inverters, data loggers, controllers, etc.) are accessible via the internet, of which 514 are located in Hungary.” The company used its own proprietary search tool for this purpose, which allows for complex searches down to the specific product type level among devices accessible on the internet.

However, based on his previous research, Kocsis felt the number of unprotected Hungarian devices was too low. We also reported on a similar previous study: in 2021, he investigated the security of domestic webcams and found that images from more than 1,000 Hungarian cameras are accessible without protection on the internet, meaning hackers could freely view live feeds of bedrooms or baby cribs in strangers’ homes, or the interiors of offices.

"If someone is not familiar with the types of equipment used in a specific sector or target area (for example, what equipment is typical for domestic production), they will likely fail to identify many of them," Kocsis wrote. Consequently, he reached out to Modat and, with their assistance and by utilizing their tool, conducted a data collection effort specifically focused on Hungary.

“Like all such device-discovery-based research, mine is not perfect, and I do not know every device. Nevertheless, 1,916 domestic photovoltaic power generation services accessible from the public internet have been identified.”

To be precise, at least 1,916 such devices—namely inverters, data loggers, storage systems, and production management tools—were identified. “There is certainly more than this, as I am not familiar with every possible device. So please consider this figure as a minimum,” he noted, adding that “a good number of devices came to my attention after the data collection, so I did not include them in the count.” Among the unprotected devices, he identified types that are not used in residential solar power systems but are specifically deployed in larger solar parks.

The web-based admin interfaces of the discovered devices were riddled with vulnerabilities. Some of these vulnerabilities had been identified as early as 2016, meaning no one has patched them with updates in over a decade. The Modat search engine detected a total of 9,554 vulnerabilities, of which 1,610 were classified as critical and an additional 3,239 as high severity.

Kocsis noted that while in the IT (information technology) world, the timely installation of updates is critical, the situation is different for OT (operational technology), or the cyber-physical systems characteristic of production equipment. For these devices, uninterrupted and continuous operation is the priority, as it is not possible to simply shut down machines in a factory for the sake of a single update. Therefore, the issue is not the delay in applying updates, but the fact that these devices are accessible through the open internet in this unprotected state.

Kocsis also identified at least 647 photovoltaic services that are not only visible but can likely be remotely switched on and off through their MODBUS industrial network protocol, which is accessible without authentication, allowing control over the inverters of the solar panels. Furthermore, he found several web interfaces that are accessible without any form of authentication, meaning that intervention in the operation of the affected devices is also possible through these interfaces.

“Domestic (and of course international) experts have been pointing out for years that something needs to be done, because the published devices, vulnerabilities, and misconfigurations – and their widespread exploitation affecting many manufacturers – can already threaten system-level services,” Kocsis wrote. In his view, user awareness alone is no longer sufficient; the situation can only be addressed through broader cooperation. “Of course, I have written that we should not publish these devices. I have also written that there should be password protection, access control, intrusion prevention, and so on. But I believe that is not where we should start. […] I think that the prominent representatives of the power system (aggregators, distribution license holders, system operators, integrators) and the government’s cyber defense and competent authorities need to start acting together. And quickly.”

In the more detailed study, Kocsis presents further examples of the cybersecurity risks associated with solar and wind energy generation and storage systems, as well as their potential impact and consequences on the power system.

Following the publication of our article, Huawei, one of the manufacturers of the affected devices, responded to the findings of the study. “We appreciate the work of the researcher, which, by examining products from multiple manufacturers, draws attention to the ongoing cybersecurity challenges affecting the entire renewable energy industry,” the company stated, adding that it “treats cybersecurity and data privacy as top priorities, committed to providing modern and reliable energy generation and management solutions that meet the highest security standards.” The company also noted that in 2025, it became the first in Hungary to obtain a cybersecurity IoT certificate from the Authority for the Supervision of Regulated Activities for its residential inverters.

“The published blog post and report did not identify a specific product vulnerability in Huawei’s power plant SmartLogger devices. Instead, it correctly drew attention to security risks arising from the operator’s network configuration and the devices’ public accessibility on the internet. The SmartLogger is a device designed to operate in a protected network environment. Establishing and maintaining appropriate network protection falls within the purview of power plant operators. Cybersecurity is a shared responsibility. We would like to emphasize the importance of adhering to security regulations and regularly applying updates,” the statement read.

Our article has been updated with Huawei’s response.