Solar Systems in the Crosshairs: NTC Uncover Cybersecurity Vulnerabilities in Photovoltaics
The National Cybersecurity Testing Institute (NTC) tested seven inverters and four energy management systems for vulnerabilities and identified over 50 findings, seven of which were critical. Since photovoltaic systems have become systemically important for the Swiss power grid, the NTC is issuing specific recommendations for operators, installers, manufacturers, policymakers, and government agencies.
Photovoltaic systems have long been critical to Switzerland’s electricity supply. By the end of 2025, approximately 338,000 grid-connected photovoltaic systems had been installed in the country. Against this backdrop, the National Testing Institute for Cybersecurity (NTC) took the initiative to test widely used systems. A total of seven inverters and four energy management systems underwent an in-depth analysis. The analysis identified over 50 vulnerabilities, including seven critical and six high-severity ones. The findings were reported to the manufacturers on a confidential basis. Most responded quickly, while the process of addressing the vulnerabilities in some products is still ongoing.
Results of the Security Analysis and Key Risk Patterns
To assess the safety level of photovoltaic technology commonly used in Switzerland, the NTC conducted a comprehensive technical safety analysis of eleven products over the course of a year: seven inverters and four energy management systems from a total of eight manufacturers, including the market-leading suppliers. In total, the tests revealed over 50 findings, seven of which were critical and six others high-risk. Five of the eleven products had at least one high or critical finding. For four products, the NTC gained complete control over the device—partly by injecting program code and partly through an inadequately protected maintenance access point provided by the manufacturer.
Four risk patterns recurred: deficiencies in authentication and access control, such as default passwords; insecure maintenance access with identical login credentials for the entire device fleet; a lack of or weak encryption for communication via local interfaces, as well as interfaces that cannot be disabled. For nearly all of the inverters tested, it was possible to use the local control interface—without logging in—to change the amount of power the system feeds into the grid, down to zero.
The security level of the individual products is no worse than that of other widely used connected devices that the NTC has already tested. No evidence of intentionally built-in backdoors was found, and most manufacturers responded quickly to the reported vulnerabilities. What distinguishes solar systems from other connected devices is not their product quality, but their role: collectively, they are systemically important to the power grid. On sunny days, they regularly cover more than half of the current electricity consumption around noon.
The key factor determining a finding’s relevance to the grid is not its severity alone, but its scope. An individual solar system on a residential or commercial roof has no impact on the power grid: if it fails or is tampered with, it does not affect the overall system. The risk arises from the fact that many of these systems are connected via the manufacturers’ cloud platforms and receive firmware updates, for example, through this channel. Six of the vulnerabilities affect an entire fleet of devices—and thus potentially thousands of systems simultaneously—via such a central platform.
«It’s not the severity of a vulnerability alone that makes it dangerous, but its scope,» says Tobias Castagna, head of testing at NTC. «With photovoltaic systems, a single issue in a central component can affect thousands of systems at once—which is why targeted yet feasible countermeasures are needed here.»
Recommendations for risk minimization
The NTC had already shared the findings with the affected manufacturers prior to the report’s publication. Many responded immediately and have already addressed the vulnerabilities. Based on the findings of this investigation, the NTC has formulated recommendations for five target groups regarding measures to reduce cyber risks in photovoltaic systems.
Operators of small-scale systems should choose an established provider, have individual passwords confirmed at the time of handover, and clarify responsibility for updates in the contract. Operators of larger systems are required to inventory interfaces and remote access points, implement network isolation, and include security requirements in their requests for proposals. Installation companies should assign unique login credentials for each system, avoid direct accessibility from the Internet, ensure isolation from the rest of the network, and document the handover.
Manufacturers are required to embed security as a design principle—with unique access credentials, signed firmware updates, time-limited and revocable maintenance access, and a factory-set lock on grid-related remote control that can only be disabled on-site. Policymakers and regulatory authorities should establish minimum requirements for the marketing of inverters and energy management systems, define security requirements as a condition for grid connection, and establish a designated entity responsible for the risk posed by the aggregate of small-scale installations.
There is no single, simple, and comprehensive solution; all approaches have advantages and disadvantages, and the recommendations do not cover the entire range of possible measures. However, every measure that is implemented enhances cybersecurity.
The study was conducted at the initiative of the National Testing Institute for Cybersecurity (NTC), which also provided the testing team and a significant portion of the funding. The study received financial support from EnergieSchweiz. Several organizations, mostly from the energy sector, provided test equipment and contributed to the costs. To ensure the independence of the results, neither the manufacturers nor the supporting organizations influenced the selection, scope of testing, or results; the manufacturers were contacted only as part of the confidential disclosure process to address the vulnerabilities.
The National Testing Institute for Cybersecurity (NTC) contributes to Switzerland’s security and digital sovereignty by proactively identifying critical vulnerabilities in digital products and risks associated with new digital technologies, and by supporting efforts to mitigate them. As a nonprofit association based in Zug, the NTC adheres to the principles of independence and objectivity. The NTC tests, on its own initiative, digital products and applications that are not sufficiently tested in Switzerland but are of great importance to the economy and society. The NTC also conducts cybersecurity assessments on behalf of critical infrastructure operators and government agencies.
