129 matches found
CVE-2025-24315 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can add devices of other users to their scenes or arbitrary scenes of other arbitrary users...
CVE-2025-24315 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can add devices of other users to their scenes or arbitrary scenes of other arbitrary users...
CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-30257 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...
CVE-2025-30257 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...
CVE-2025-31147 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users...
CVE-2025-31360
CVE-2025-31360 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources confirm an unauthenticated attacker can trigger device actions associated with specific “scenes” of arbitrary users, implying remote control of devices without user interaction. The vulnerability ...
CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...
CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...
CVE-2025-30512 Growatt Cloud portal External Control of System or Configuration Setting
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
CVE-2025-30512 Growatt Cloud portal External Control of System or Configuration Setting
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
CVE-2025-27927 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...
CVE-2025-27927 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...
CVE-2025-24297
CVE-2025-24297 affects Growatt Cloud Portal (Growatt Cloud Applications). Root cause: lack of server-side input validation leading to cross-site scripting. Vulnerable component/function: plant name handling during add/edit operations (stored XSS). Impact: attackers can inject JavaScript into user...
CVE-2025-24297 Growatt Cloud portal Cross-site Scripting
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal...
CVE-2025-24297 Growatt Cloud portal Cross-site Scripting
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal...
CVE-2025-30510
Growatt Cloud Applications (version 3.6.0 and earlier) is affected by a vulnerability where an attacker can upload an arbitrary file in place of a plant image. Public sources note this in multiple records (CNNVD, RH/Red Hat CVE, NVD). Some documents also describe related issues involving improper...
CVE-2025-30510 Growatt Cloud portal Insufficient Type Distinction
An attacker can upload an arbitrary file instead of a plant image...