CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6)

CISA has issued a security advisory highlighting a critical vulnerability in SunPower PVS6 solar inverters, tracked as CVE-2025-9696 and rated CVSS 9.6. The flaw stems from hardcoded encryption parameters in the BluetoothLE interface of the PVS6, and according to CISA, “The SunPower PVS6’s BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details.

An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device’s servicing interface.” Successful exploitation could allow adversaries to replace device firmware, disable solar power production, modify grid settings, create SSH tunnels and alter firewall rules, and manipulate connected devices. CISA confirmed that SunPower PVS6 versions 2025.06 build 61839 and prior are impacted, and noted that no public exploitation has been observed yet.

The agency recommends minimising network exposure for control system devices, placing them behind firewalls, isolating control networks, and using secure VPNs for remote access while keeping them updated. According to CISA, SunPower should be contacted for remediation guidance.