Hi everyone, yesterday, I updated my GX firmware to the current version 3.80 as well as the GX Android display to version 1.2. Many great improvements. Super job, Victron, thank you ![]()
On this occasion, I checked the GX security settings for VRM access once again and noticed that VRM still requires “Full” access when DESS (Dynamic ESS) is activated.
Especially in times of highly sophisticated AI-driven attacks and conceivable blackout scenarios, a residential Victron installation should be as secure against hacker attacks as humanly possible. However, setting GX VRM to “Full” enables numerous critical options for manipulation via the internet if someone manages to hack into the system—despite MFA and strong passwords—up to full control of the GX via Remote Console. I consider this outdated and unsafe.
My system is configured for DESS and actually only needs the Target SoC and the grid cost per kWh from the outside. Everything else could and should be read-only and 100% isolated from the internet. Unfortunately, I cannot find any configuration option for this. GX could query the required information on its own. There is no need to push or configure anything from the internet on my local system
Power supply undoubtedly belongs to critical infrastructure that requires high protection. Are there any improvements planned in this direction following a “least privilege” cybersecurity principle? I do not want to expose any system setting, remote update or remote console to the cloud via VRM just because I run the ESS in DESS mode.
If this setting already exists and I was simply too blind to find it, I sincerely apologize in advance and say THANK YOU ![]()
