Ian van der Wurff

Across the Caribbean, solar energy is no longer supplemental infrastructure, on many island grids it has become core to day-to-day power generation. During peak solar hours, photovoltaic (PV) systems can supply more than half of all electricity on the grid, with inverter logic and battery storage continuously balancing stability, frequency, and load demand. That transition has quietly introduced a new dependency: thousands of internet-connected inverters and energy management systems from a small number of global vendors operating deep inside critical infrastructure.

This talk presents a real-world reverse engineering and exploit development case study of production firmware from one of the world’s largest solar inverter manufacturers. Our research uncovered multiple vulnerabilities that allowed unauthenticated attackers (both remotely over the internet and locally on adjacent networks) to gain full control over deployed systems and disrupt them if wanted.

We will demonstrate how these weaknesses could enable falsification of energy telemetry, remote shutdown of distributed solar assets during peak demand, manipulation of grid-balancing behavior, and lateral movement into operational energy environments. Beyond the technical findings, the session examines the broader implications for island nations and other regions rapidly adopting distributed renewable energy infrastructure.

Key takeaways (3–5 bullet points)

- A single weakness in one vendor's firmware is a problem for an entire region

- Your rooftop solar panels are now part of critical national infrastructure

- Audit before distributing