NTC finds default passwords, fleet-wide shared credentials and unauthenticated grid-feed shutoff across Swiss solar inverters, with a named cantonal procurement gap
Switzerland's national cybersecurity test institute finds most tested solar inverters let an unauthenticated user zero out grid feed-in
Analysis
Switzerland's National Test Institute for Cybersecurity (NTC) published a year-long technical security assessment (2026-09-17) of seven solar inverters and four energy-management systems from eight manufacturers, of the kind installed in thousands of Swiss homes (NTC, 2026-09-17) among Switzerland's roughly 338,000 grid-connected photovoltaic installations (cash.ch, 2026-09-17). Testing produced more than 50 findings, seven critical and six high, with full device takeover on four of the eleven products (NTC, 2026-09-17). The recurring weaknesses: default passwords, maintenance access using identical credentials across an entire device fleet, weak or missing encryption on local-interface communication, and interfaces that cannot be disabled. On almost every inverter tested, the local control interface let an unauthenticated actor change how much power the installation feeds into the grid, down to zero, with no login required (NTC, 2026-09-17); NTC found no evidence of intentionally built-in backdoors, per its own statement, framing the risk instead as manufacturer-cloud concentration (cash.ch, 2026-09-17). NTC warns that thousands of installations connect to a small number of manufacturer clouds, so an attacker who gains control of one manufacturer's cloud could trigger the same change in grid feed-in across thousands of connected installations at once, and that the fleet as a whole constitutes critical infrastructure (NTC, 2026-09-17). NTC founder Raphael Reischuk states that if the Chinese manufacturers were to simultaneously switch off all their devices at full power, a collapse of the Swiss power grid would threaten (translated from German) (Raphael Reischuk, NTC, via SRF, 2026-09-16), and Switzerland's Federal Office of Energy confirms the analysis, saying the risk of a coordinated attack cannot be ruled out (translated from German) (SRF, 2026-09-16).
The market-concentration and procurement angle is directly relevant to Swiss public-sector buyers: Huawei and Sungrow together hold over 60% of the Swiss inverter market, Switzerland's Federal Intelligence Service (NDB) warns the country risks becoming a preferred target if it protects critical infrastructure less than the EU, and SRF reports that canton Bern's building authority tendered a cantonal vocational school's solar installation so that in practice only a Huawei inverter qualified; the authority says it did not specify the manufacturer but concedes that cybersecurity is "still barely anchored" in tenders (translated from German) (SRF, 2026-09-16). The EU has withdrawn subsidy eligibility for Chinese-inverter projects and the US has declared a grid emergency that can force removal of already-installed sanctioned-country inverters (SRF, 2026-09-16). NTC deliberately withheld product names and technical exploit detail, reporting findings confidentially to manufacturers, and states most manufacturers responded quickly to the disclosure while work to fix the vulnerabilities remains under way for some products (NTC, 2026-09-17); cash.ch separately reports that most manufacturers responded quickly and have already closed gaps (translated from German) (cash.ch, 2026-09-17). Neither NTC nor cash.ch names a CVE for any of the findings (NTC, 2026-09-17; cash.ch, 2026-09-17).
Cited evidence
In total, the assessments produced more than 50 findings, seven of them critical and a further six rated high.
On almost every inverter tested, the local control interface makes it possible (without any login) to change how much power the installation feeds into the grid, all the way down to zero.
on four products, the NTC gained complete control over the device
If the Chinese manufacturers were to simultaneously switch off all their devices at full power, a collapse of the Swiss power grid would threaten. (translated from German)
Asked about this, the Baudirektion writes that it did not specify the manufacturer. It does concede, however, that cybersecurity is "still barely anchored" in tenders. (translated from German)
Updates2
The corroboration behind this entry is editorial rather than independent, and its credibility rating now says so. The National Test Institute for Cybersecurity ran the tests and published the findings; SRF and cash.ch report on that study rather than testing the devices themselves, and the Federal Office of Energy endorsed the institute's analysis rather than conducting its own. That is one assessor with several publishers, so the rating moves from confirmed to probably true. Every figure in the entry was re-checked against the institute's own publication and none of them changes (National Test Institute for Cybersecurity, 2026-09-17).
SRF, not canton Bern's building authority, describes the vocational-school tender as one that in practice only a Huawei inverter could meet; the authority told SRF it did not specify the manufacturer and conceded only that cybersecurity is "still barely anchored" in tenders (translated from German) (SRF, 2026-09-16). SRF reports that the Federal Office of Energy confirms the analysis, saying the risk of a coordinated attack cannot be ruled out (translated from German), not that it confirmed the assessment independently (SRF, 2026-09-16). Neither NTC nor cash.ch names a CVE for the findings, and neither says that none was assigned (NTC, 2026-09-17) (cash.ch, 2026-09-17). NTC puts the reach of a compromised manufacturer cloud at thousands of connected installations whose feed-in could be changed, not at every installation (NTC, 2026-09-17).
Sources3
Revision history
- Published 2026-09-18T0410Z-intel
- Correction 2026-09-20T1308Z-audit
Credibility was rated 1 (corroborated by independent sources). Every cited source traces to the National Test Institute for Cybersecurity's own study: SRF and cash.ch report on it and the Federal Office of Energy endorsed it, and none of them re-tested the inverters. That is one assessor with several publishers, which rates 2. A sourcing note now records the provenance. The findings themselves were re-verified against the institute's own publication and are unchanged.
Changed: classification sourcing_note
- Correction 2026-09-30T0639Z-audit
Priority recalibrated from high to notable: a research assessment of consumer solar inverters with no operational decision due this week. The Bern tender is attributed to SRF, since the building authority denies specifying the manufacturer and concedes only the cybersecurity point. The Federal Office of Energy's confirmation is no longer called independent, the CVE statement is limited to what NTC and cash.ch say, the cloud-compromise scenario follows NTC's thousands of installations. The findings rest on one assessor, NTC, reported by several publishers.
Changed: priority body verification summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.