Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
To quantify the cyber-physical vulnerabilities of decentralized power systems, the authors conducted a global Internet-scale census of grid-connected solar distributed energy resources (DERs) paired with power system simulations on the standard Oahu grid model. This analysis matters because the rapid rollout of unmanaged, Internet-facing renewable edge devices introduces unvetted threat vectors that can bypass traditional utility-level cyber defenses. The scan uncovered over 66,000 Internet-exposed solar DERs—with at least 10,000 susceptible to critical CVEs like unauthenticated control endpoints—which simulations show can be exploited to cause severe voltage anomalies, equipment damage, and localized grid failure.
Exploiting a fraction of the 66,000+ unauthenticated, internet-exposed solar inverters discovered online is sufficient to trigger line-flow violations and destabilize an entire regional power grid.
Grid-connected solar distributed energy resources (DERs), such as solar inverters and monitoring platforms, have been deployed at unprecedented scale over the past few years, with global solar capacity more than doubling since 2022. To support monitoring and control, many of these systems are Internet-connected and configured by installers or end users, yet the real-world scale of their Internet exposure and the implications for power grid operation remain poorly understood. In this paper, we present an Internet-scale evaluation of exposed and vulnerable solar DER infrastructure, and assess the risk that compromised DERs can pose to energy grids. We develop a method for accurately identifying solar DERs from Internet scanning data, and discover a diverse population of over 66,000 Internet-exposed solar DERs. We detect that at least 10,000 of these DERs may have known CVEs, such as unauthenticated monitoring and control endpoints. To assess the risk that these vulnerable DERs pose to a power grid, we use an electric grid network for Oahu, Hawaii, established and used by the power system research community, and conduct a power system analysis. Our evaluation shows that by compromising exposed DERs, attackers can cause voltage and line flow violations across multiple locations in the Oahu network, resulting in a range of consequences from degraded power quality to damaged power system components to power outages. Ultimately, our work brings to light the emerging threat of grid-connected DERs, and provides directions for improving energy security.