Invertor Security

Executive Summary

Assessment activities identified recurring weaknesses in inverter deployments, including hidden communications systems, insecure default configurations, poor visibility, and undocumented connectivity. These issues present both cybersecurity and grid-reliability concerns.

Key Findings

Rogue and Undocumented Components

• Unexpected wireless devices were detected during assessments.
• Undocumented 868 MHz and 900 MHz communications were observed.
• Cellular modems were found despite manufacturer assertions that they should not be present.

Hidden Cellular Connectivity

• Quectel BG95-M1 LTE modem with SIM card identified within an inverter.
• ESP32 microcontroller observed interfacing with inverter communications.
• Devices were observed attempting cellular communications.

Configuration Weaknesses

• Default passwords remained in use.
• SSH services were enabled.
• Open MongoDB and NTP services were identified.
• External DNS configurations were observed.

Lessons Learned

• Insecure default configurations create immediate risk.
• Credential-lockout and throttling protections are often absent.
• Outdated firmware increases exposure to known vulnerabilities.
• Manufacturer security assurances cannot always be independently validated.
• Hidden communications increase lifecycle and supply-chain risk.

Recommendations

• Conduct physical walkdowns and validate inventories.
• Remove or disable unnecessary wireless functionality.
• Implement secure reference architectures.
• Standardize commissioning security checklists.
• Perform network analysis, red-team assessments, and IDS reviews.