Sungrow welcomes security researchers, customers, partners, and other stakeholders to report potential security vulnerabilities in our products and services. Your feedback helps us continuously improve product security and better protect our customers and business operations.

If you discover any security vulnerabilities within Sungrow’s products or services, please submit your vulnerability report via the channel below.

Submission Channel

Email:psirt@sungrowpower.com

To protect the confidentiality of vulnerability details, PGP-encrypted submission is highly recommended.

PGP Public Key:48DC700294BC32C1
Key Fingerprint:AEF29AB58E8626351AE8913448DC700294BC32C1
Download Link:https://keys.openpgp.org/search?q=AEF29AB58E8626351AE8913448DC700294BC32C1

Privacy Notice

When submitting a vulnerability report by email, Sungrow will process your contact details and personal data within your message/attachments to assess & handle the report, communicate remediation, coordinate disclosure and meet legal obligations.

Please provide only vulnerability-proof necessary information. Remove/mask unrelated personal data (especially data of third parties). Do not include passwords, private keys or active credentials.

Without your separate consent, your contact data will not be used for marketing or public acknowledgement attribution. Personal data will be retained only for the period necessary for above purposes.

For details of personal data handling and your rights, refer to the Sungrow Website Privacy Policy.

Information to Include

To help us efficiently analyze and validate reported vulnerabilities, please provide as much of the following information as possible:

Product name and model

Software, firmware, or system version

Detailed description of the vulnerability

Potential impact and risk assessment

Steps required to reproduce the vulnerability

Test environment information

Proof-of-Concept (PoC) code, test scripts, logs, screenshots, or other supporting materials

Contact information (optional)

The more complete the information you provide, the more efficiently we can evaluate and address the reported issue.

Vulnerability Report Template & Anonymous Submission

You may refer to the Vulnerability Report Template to structure your report.

Anonymous submissions are accepted. Please note, however, that if no valid contact information is provided, we may be unable to communicate with you regarding validation results, remediation progress, or other follow-up matters.

Response Commitment

Upon receiving a vulnerability report, the Sungrow PSIRT will initiate analysis and validation as soon as possible.

Under normal circumstances:

Receipt of your report will be acknowledged within 2 days.

Initial assessment and validation results will be provided within 7 days.
We will keep reporters informed of significant progress throughout the vulnerability handling process. For complex vulnerabilities or vulnerabilities affecting multiple products, additional time may be required for thorough investigation and remediation.

After You Submit

All reports are handled under Sungrow's standardized PSIRT workflow: Reception → Assessment → Remediation → Disclosure → Improvement. See the Vulnerability Response Process tab for details.

For disclosure principles, confidentiality obligations, safe harbor provisions, and reporter recognition, please refer to our Vulnerability Disclosure Policy.

Reception

Sungrow continuously identifies potential vulnerabilities through multiple channels, including reports from security researchers, customers, partners, and suppliers, as well as proactive threat intelligence detection.

Dedicated security email:psirt@sungrowpower.com

Official PSIRT Portal:https://sungrowpower.com/en/security-incident-response

Dedicated reporting channel

Proactive threat intelligence monitoring

Assessment

Validation:Verify the authenticity and reproducibility of the reported vulnerability

Impact Analysis: Assess affected products, versions, and customer impact

Risk Rating:Evaluate severity using CVSS methodology

Prioritization:Determine remediation priority and response plan

Remediation

Develop remediation plans

Provide temporary mitigation measures when applicable

Develop and test security patches

Validate remediation effectiveness

Prepare customer deployment guidance

Disclosure

Maintain continuous communication with vulnerability submitters and provide regular progress updates throughout remediation.

Issue timely security advisories to all affected customers.

Support customers with remediation planning and relevant technical assistance.

Execute coordinated public disclosure after patches and fixes are fully ready.
Coordinated Disclosure Principles

Vulnerability details will not be publicly disclosed until remediation is available.

Disclosure timing is coordinated with the reporting party.

Customers are provided with sufficient time to deploy mitigations and updates.

Improvement

Sungrow conducts regular vulnerability reviews and improvement initiatives, carrying out technical and procedural reviews to identify root causes and define corrective actions. Lessons learned from these activities are incorporated into our secure development processes, product security controls and vulnerability response framework, enabling continuous enhancement of our security defense capabilities.

Overview

Sungrow is committed to maintaining the security of its products, services, and customers. We welcome security researchers, customers, partners, and other stakeholders to responsibly report potential security vulnerabilities that may affect Sungrow products, systems, or services.

For reporting channels, PGP encryption details, required report content, and Sungrow's response commitments, please refer to the Report a Vulnerability tab.

Scope

This policy applies to all of Sungrow's products.

How to Report a Vulnerability

For reporting channels, PGP encryption details, required report content, and Sungrow's response commitments, please refer to the Report a Vulnerability tab.

Coordinated Vulnerability Disclosure

Sungrow manages vulnerability disclosure following coordinated vulnerability disclosure (CVD) principles.

Confidentiality

Sungrow will treat non-public vulnerability information as confidential and restrict access to individuals and organizations that reasonably require the information for vulnerability analysis, remediation, coordination, customer protection, or compliance purposes. Where necessary, vulnerability information may be shared with relevant Sungrow affiliates, suppliers, technology partners, affected customers, CSIRTs and competent authorities, or other parties involved in remediation. Sungrow may also disclose such information where required by applicable law. Where reasonably possible, Sungrow will seek to ensure that parties receiving non-public vulnerability information apply appropriate confidentiality protections. Reporters are requested to keep non-public vulnerability details confidential during Sungrow’s investigation, remediation, and until the agreed coordinated public disclosure date.

Disclosure Coordination

Once a vulnerability has been validated, Sungrow PSIRT will work with the reporter in good faith to coordinate an appropriate public disclosure timeline.

The disclosure timeline may take into account factors including:

Severity and exploitability of the vulnerability

Availability and deployment of mitigations or patches

Customer safety and operational impact

Product and supply-chain dependencies

Time reasonably required for affected customers to implement remediation

Applicable legal and regulatory obligations

Reporters are requested not to publicly disclose detailed technical information, proof-of-concept code, exploit code, or other information that could materially increase risk to customers before the coordinated disclosure date.

Sungrow will seek to avoid unnecessary delays in coordinated disclosure and will communicate with the reporter if additional remediation time is reasonably required.

Once disclosure has been coordinated, the reporter and Sungrow may agree on appropriate publication methods, including security advisories, vulnerability databases, technical publications, or conference presentations.

General

Nothing in this Policy is intended to prevent disclosures required by applicable law.

Safe Harbor

Sungrow appreciates and supports good-faith, responsible security research activities.

For individuals conducting security research in good faith and complying with this Policy, Sungrow commits that it will not initiate lawsuits or take legal action against them, provided all of the following conditions for the research activities are met:

Reproduce vulnerabilities only through verification with minimal impact; do not tamper with, delete or steal business data or device configurations. Immediately terminate testing and submit a report upon accessing any sensitive data.

Do not cause service disruption to customers, partners or Sungrow.

Do not launch Denial-of-Service (DoS) attacks.

Do not leverage vulnerabilities for lateral movement, persistent control or further exploitation attacks.

Do not profit from vulnerabilities, engage in extortion, or trade vulnerability information.

Do not violate any applicable laws and regulations.

Do not publicly disclose vulnerability details before the corresponding patch is fully released.

Sungrow reserves the right to take appropriate measures if any research activity falls outside the scope specified above.

Personal Safety Tips

Some Sungrow products involve high-voltage power equipment, which carries safety risks such as electric shock and arc flash. Researchers should conduct testing in a safe environment, comply with electrical work safety regulations, and wear appropriate personal protective equipment where necessary.

Acknowledgements And Recognition

Sungrow appreciates the valuable contributions of the security research community.

For valid and responsibly reported vulnerabilities, Sungrow may acknowledge the reporter's contribution. With the reporter's consent, recognition may be provided through security advisories, acknowledgments, or other appropriate channels.

Currently, Sungrow does not operate a public bug bounty program. Should such a program be introduced in the future, detailed information will be published on the official website.

Contact

For questions regarding this VDP or other product security matters, please contact Sungrow PSIRT:psirt@sungrowpower.com

Policy Version: 1.0
Last Updated: 20.09.2026