NTC Cybersecurity of Photovoltaic Systems (2026)

NTC finds default passwords, fleet-wide shared credentials and unauthenticated grid-feed shutoff across Swiss solar inverters, with a named cantonal procurement gap

Switzerland's National Test Institute for Cybersecurity (NTC) published a year-long technical security assessment (2026-09-17) of seven solar inverters and four energy-management systems from eight manufacturers, of the kind installed in thousands of Swiss homes (NTC, 2026-09-17) among Switzerland's roughly 338,000 grid-connected photovoltaic installations (cash.ch, 2026-09-17). Testing produced more than 50 findings, seven critical and six high, with full device takeover on four of the eleven products (NTC, 2026-09-17). The recurring weaknesses: default passwords, maintenance access using identical credentials across an entire device fleet, weak or missing encryption on local-interface communication, and interfaces that cannot be disabled. On almost every inverter tested, the local control interface let an unauthenticated actor change how much power the installation feeds into the grid, down to zero, with no login required (NTC, 2026-09-17); NTC found no evidence of intentionally built-in backdoors, per its own statement, framing the risk instead as manufacturer-cloud concentration (cash.ch, 2026-09-17). NTC warns that thousands of installations connect to a small number of manufacturer clouds, so an attacker who gains control of one manufacturer's cloud could trigger the same change in grid feed-in across thousands of connected installations at once, and that the fleet as a whole constitutes critical infrastructure (NTC, 2026-09-17). NTC founder Raphael Reischuk states that if the Chinese manufacturers were to simultaneously switch off all their devices at full power, a collapse of the Swiss power grid would threaten (translated from German) (Raphael Reischuk, NTC, via SRF, 2026-09-16), and Switzerland's Federal Office of Energy confirms the analysis, saying the risk of a coordinated attack cannot be ruled out (translated from German) (SRF, 2026-09-16).

The market-concentration and procurement angle is directly relevant to Swiss public-sector buyers: Huawei and Sungrow together hold over 60% of the Swiss inverter market, Switzerland's Federal Intelligence Service (NDB) warns the country risks becoming a preferred target if it protects critical infrastructure less than the EU, and SRF reports that canton Bern's building authority tendered a cantonal vocational school's solar installation so that in practice only a Huawei inverter qualified; the authority says it did not specify the manufacturer but concedes that cybersecurity is "still barely anchored" in tenders (translated from German) (SRF, 2026-09-16). The EU has withdrawn subsidy eligibility for Chinese-inverter projects and the US has declared a grid emergency that can force removal of already-installed sanctioned-country inverters (SRF, 2026-09-16). NTC deliberately withheld product names and technical exploit detail, reporting findings confidentially to manufacturers, and states most manufacturers responded quickly to the disclosure while work to fix the vulnerabilities remains under way for some products (NTC, 2026-09-17); cash.ch separately reports that most manufacturers responded quickly and have already closed gaps (translated from German) (cash.ch, 2026-09-17). Neither NTC nor cash.ch names a CVE for any of the findings (NTC, 2026-09-17; cash.ch, 2026-09-17).