CVE-2025-25276 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can hijack other users' devices and potentially control them...

CVE-2025-25276 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can hijack other users' devices and potentially control them...

CVE-2025-27565 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs...

CVE-2025-27565

CVE-2025-27565 affects the Growatt Cloud Applications/Cloud portal. Multiple connected sources confirm an unauthenticated attacker can delete any user’s legitimate data by knowing the user ID and the target room ID, implying an authorization failure in manipulating user-controlled room resources....

CVE-2025-27565 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs...

CVE-2025-27575 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID...

CVE-2025-27575

Consolidated details from connected sources show a vulnerability affecting Growatt Cloud Applications (EV charger management) that allows an unauthenticated attacker to learn the EV charger version and firmware upgrading history by knowing the charger ID. Root cause appears to be information disc...

CVE-2025-27575 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID...

CVE-2025-31950

Growatt Cloud Applications (affected: version 3.6.0 and earlier) exposes an information-disclosure vulnerability allowing an unauthenticated attacker to obtain other users’ EV charger energy consumption data. Root cause: improper access control enabling retrieval of sensitive energy data. Impact ...

CVE-2025-31950 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger energy consumption information of other users...

CVE-2025-31950 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger energy consumption information of other users...

CVE-2025-31945 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain other users' charger information...

CVE-2025-31945

CVE-2025-31945 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources confirm an unauthenticated attacker can obtain other users’ charger information, exposing sensitive user data. Public details indicate vulnerable component exposure and lack of server-side input v...

CVE-2025-26857 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename arbitrary devices of arbitrary users i.e., EV chargers...

CVE-2025-26857 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename arbitrary devices of arbitrary users i.e., EV chargers...

CVE-2025-26857

CVE-2025-26857 affects Growatt Cloud Applications (vulnerable through 3.6.0 and earlier according to CNNVD). The flaw allows an unauthenticated attacker to rename arbitrary devices owned by any user (notably EV chargers) by exploiting insufficient input validation. Multiple connected sources (Red...

CVE-2025-27719

CVE-2025-27719 affects Growatt Cloud Applications (Growatt Cloud portal). An unauthenticated user can query an API endpoint and obtain device details, indicating an information-disclosure risk. Connected sources indicate this vulnerability exists in Growatt Cloud Applications version 3.6.0 and ea...

CVE-2025-27719 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can query an API endpoint and get device details...

CVE-2025-27719 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can query an API endpoint and get device details...

CVE-2025-31654

CVE-2025-31654 concerns Growatt Cloud Applications where an attacker can obtain information about the groups of smart home devices for arbitrary users (i.e., the users’ “rooms”). The CVE appears across multiple sources (NVD, Red Hat, CVE List, CVSS metrics) and is associated with the Growatt clou...