CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover

According to The Cybersecurity and Infrastructure Security Agency (CISA), a high-severity alert (ICSA-25-245-03) warns of a critical vulnerability in SunPower’s PVS6 solar inverter series that could allow attackers on adjacent networks to gain complete control of the device. The flaw, CVE-2025-9696, stems from hard-coded credentials in the Bluetooth Low Energy servicing interface and is rated 9.4 on CVSS v4 (9.4 base score) and 9.6 on CVSS v3.1 (base score), posing an urgent risk to energy infrastructure worldwide.

An attacker within Bluetooth range—around 50 metres under ideal conditions—can use these credentials to access the device’s servicing port and potentially upload malicious firmware, reconfigure settings, or disable power production. SunPower PVS6 units with firmware versions 2025.06 build 61839 and earlier are affected, and the advisory notes that the attack cannot be launched remotely over the internet but many installations expose Bluetooth interfaces without proper network segmentation.

Mitigations include network segmentation, disabling or isolating Bluetooth interfaces, restricting internet access to control interfaces, and enforcing hardened VPNs with up-to-date firmware and MFA, with SunPower yet to publicly respond to the coordination requests.