Critical vulnerabilities reported in EG4 electronics solar inverters
Take action: If you have EG4 solar inverters, make sure they are isolated them from internet access and accessible only from trusted networks or VPN. Then reach out to the vendor for the firmware updates.
Learn More
EG4 Electronics is reporting multiple security vulnerabilities affecting its solar inverters product lines.
Vulnerabilities summary
- CVE-2025-46414 (CVSS score 9.2) - Improper Restriction of Excessive Authentication Attempts: Allows unlimited PIN brute-force attempts for registered devices, enabling unauthorized access through automated attacks
- CVE-2025-53520 (CVSS score 8.6) - Download of Code Without Integrity Check: Permits installation of unverified firmware updates that can be modified or contain malicious code
- CVE-2025-52586 (CVSS score 7.5) - Cleartext Transmission of Sensitive Information: Exposes all MOD3 command traffic between monitoring applications and inverters in unencrypted plaintext
- CVE-2025-47872 (CVSS score 6.9) - Observable Discrepancy: Reveals device registration status through differential server responses, facilitating reconnaissance attacks
Affected devices are EG4's complete inverter portfolio, with all firmware versions of these devices
- EG4 12kPV,
- EG4 18kPV,
- EG4 Flex 21,
- EG4 Flex 18,
- EG4 6000XP,
- EG4 12000XP,
- EG4 GridBoss models
EG4 Electronics has acknowledged the vulnerabilities and is developing remediation measures, including new patches expected by October 15, 2025. The company is actively monitoring all installed systems and working with affected customers on a case-by-case basis to detect and respond to any anomalous activity.
The authentication brute-force vulnerability (CVE-2025-46414) was already fixed through a server-side update deployed on April 6, 2025, requiring no customer action.
Organizations should ensure that all inverter systems are isolated from internet-accessible networks, deploy firewall protections around control system networks, and implement secure remote access via VPN.
