The Patching Friars' AlmanacA calendar of CVE saints

March 27

SUN:DOWNHoly card for sun-down, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 SUN:DOWN SOL OCCIDIT
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint SUN:DOWN, Who Switched Off the Sun

Patron of solar inverters, apps that encrypt badly, and power grids that count on good weather.

Life

On 27 March 2025 Forescout Vedere Labs published SUN:DOWN, research gathering 46 vulnerabilities in the solar inverters of three major vendors. Among them, SunGrow's iSolarCloud app encrypted data with too weak an AES key, allowing intercepted communications to be decrypted. The researchers warned that a large fleet of hijacked inverters could be used to destabilise the power grid. The flaws were later fixed.

Prayer

O Saint SUN:DOWN, who makes the sun set at will, let our inverters encrypt with keys worthy of the name. Amen.

How to celebrate

Celebrated by updating inverter firmware and apps and taking off the public network the panels that don't belong there.

Weak key, trembling grid.

Technical record

Disclosed on
March 27 2025
CVE
CVE-2024-50684CVE-2024-50698
CVSS
9.8

SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud.

Sources: forescout.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.