Business
Security concerns grow around a popular solar inverter used in South African homes
A trusted name in home solar now under scrutiny
For many South Africans, Deye has become a familiar name during the long years of load shedding. Its hybrid inverters, especially the 5kW and 8kW models, are a common sight in suburban garages and utility rooms. They are affordable, powerful, and widely supported through official distributors and installers across the country.
But behind the scenes, a growing number of solar professionals and users are starting to question how securely these systems are being managed.
At the heart of the concern is Deye’s unusual support setup, which relies heavily on large WhatsApp groups to handle software updates, troubleshooting, and even remote access issues. While it may sound convenient, cybersecurity experts and installers say this approach could expose sensitive system information to hundreds of strangers at once.
How WhatsApp became a support shortcut
Deye uses WhatsApp groups with hundreds of installers and power users to offer fast technical support. These groups are often the quickest way to request firmware updates, rollbacks, or changes needed to fix performance problems.
In practice, this means installers or users post photos of their inverter data loggers directly into the group. These images clearly show the logger’s serial number and password. That information is critical because the logger allows remote access to the inverter through Solarman Business or Solarman Smart platforms.
Once shared, that data is visible to everyone in the group. In at least one reported case, a single support group had close to 900 members. Even more worrying, new people could be added and approved without clear checks to confirm they actually owned or installed Deye systems.
What could go wrong if the wrong person gets access
With a logger’s credentials, a person can remotely change almost every key setting on a Deye inverter. That includes power limits, charging behaviour, and battery management profiles.
One hypothetical but realistic scenario raised by installers is sabotage between competitors. An installer with a grudge could quietly request that another system be delinked, then relink it to their own account. From there, they would have full remote control.
The risks are not minor. By switching battery settings to the wrong mode, someone could force batteries to charge or discharge beyond safe limits. Over time, this damages expensive equipment and, in extreme cases, could lead to thermal runaway, a serious fire risk that is notoriously difficult to extinguish.
Installer access adds another layer of exposure
Many South African homeowners do not realise that installers often retain remote access to their solar systems after installation. This is standard practice across the industry and can be helpful for monitoring performance or providing fast support.
Reputable installers explain this clearly to clients. The problem is that installer accounts often control dozens or even hundreds of systems. If one of those accounts were compromised, it could expose a wide network of homes to interference.
Some installers have already changed their habits. One prominent installer said they now avoid posting customer details in public groups and instead message Deye support staff privately to reduce the risk.
Silence from the manufacturer and public reaction
When questions were put to Deye about identity verification and safeguards around delinking loggers, the company did not respond at the time. That silence has fuelled frustration among users and installers alike, especially on local tech forums and solar WhatsApp communities where the issue is being actively debated.
Many South Africans see solar as a long-term investment and a shield against unreliable power. The idea that someone could tamper with that system remotely has understandably made people uneasy.
What homeowners can do right now
There are practical steps users can take if they are worried. A compromised logger can be physically unplugged or disconnected from the Internet, instantly cutting off remote access. This is a blunt but effective solution.
More advanced users are choosing to replace the logger entirely. By running open-source platforms such as Home Assistant or SolarAssistant on a Raspberry Pi, homeowners can manage their systems locally without relying on cloud services.
As solar adoption continues to surge across South Africa, this situation highlights a bigger issue. Convenience should never come at the cost of security, especially when systems control powerful batteries and critical household infrastructure. The conversation around inverter safety is no longer just technical. It is personal.
Follow Joburg ETC on Facebook, Twitter, TikT
For more News in Johannesburg, visit joburgetc.com
Source: MyBroadband
Featured Image: Juspropa
