IDOR in SolisCloud API plant data access control

Successful exploitation allows unauthorized access to detailed plant information belonging to other tenants or users. The primary impact is confidentiality loss, including exposure of sensitive operational or monitoring data associated with arbitrary plants. Available information does not indicate direct integrity or availability impact from this specific flaw.

Until a vendor fix or authoritative remediation is available, reduce exposure of affected APIs to untrusted networks, restrict access to only required users and networks, and monitor for anomalous requests involving enumeration or unexpected changes to plant_id values. In ICS environments, follow CISA defensive guidance: minimize network exposure of control systems, place control networks and remote devices behind firewalls and isolate them from business networks, use secure remote access such as fully patched VPNs, and perform impact analysis and risk assessment before applying architectural changes.

Implement server-side object-level authorization checks for every request that references plant_id or similar object identifiers. Validate that the authenticated user is explicitly authorized to access the requested plant before returning any data. Review API access-control design across both Cloud API and Device Control API versions v1 and v2, remove any reliance on client-supplied identifiers as proof of authorization, and enforce least-privilege access policies consistently across endpoints. CISA also advises affected users to contact SolisCloud customer support for vendor guidance.